Legal Hold/Retention Questions about jira and confluence

[Lakshmi CH]

Hi Team,

We have a request from security team on some legal and retention questions. Could anyone please help us on below question ?

We are on jira server V8.13.3 and Confluence V7.4.7versions.

In both Jira and Confluence :

1. What is our current data retention policy? Is the data held forever?
2. Is there a way to "hold" (make sure nobody can edit or delete) the data if required?
3. How would we export the following from Jira and Confluence?
   1. A whole project/site
   2. Everything from a specified user(s)
   3. Everything with a specific keyword
4. What file format would these exports use?

Thanks!

[Nic Brough -Adaptavist- · Accepted solution]

Actually, there isn't much to the answers on these, the first one is the most important!

1. Data will only be deleted if one of your humans kills it.  
2. Yes, do not give anyone the right to delete it or edit it when you want to "hold" it.  You will however, need to trust your administrators to get those permissions correct, and not grant themselves delete unless you really do need something killed off or updated
3. To export
   1. For a small one, site backup.  Suitable for loading into another Jira or Confluence automatically
   2. For a large one, get a copy of the attachments and a database dump
   3. Run searches for "author = x" and export the results.  However, this is not a simple question.  You've got many potential definitions of "specified user" - reporter, creator, current assignee, past assignee, editors, commenters, people named in fields or the body of the content or comments.  With that, you can't do a simple "extract the stuff they did", it's not going to be coherent or useful.  Imagine I'd made comment 34 on an issue and said "Yay, I did that" - without the content of the rest of the issue, it's pretty useless.
   4. Pretty much the same answer for keywords - search for them and export the whole page or issue
4. Depends on your choice of export method.

[Lakshmi CH]

Thanks much for quick response @Nic Brough -Adaptavist- , Could you also please check my answers below ?

[Lakshmi CH]

Hi Team,

 I have prepared these answers, please correct me if i am wrong.

In both Jira and Confluence :

1. What is our current data retention policy? Is the data held forever?
   1. This would be defined normally by Risk and Compliance - by default jira will not delete anything unless a user actually deletes the project
2. Is there a way to "hold" (make sure nobody can edit or delete) the data if required?
   1. Only system administrators can delete a project. To avoid this in jira Adjust the permissions scheme to not allow any users besides jira-admins to access the project
3. How would we export the following from Jira and Confluence?
   1. A whole project/site
      use Advanced Search and query for the project and export all the data with all fields selected to csv
      You can export a space from within the space settings (content tools --> export)
   2. Everything from a specified user(s)
      1. jira - use advanced search, need to define what criteria is to be used to identify that user (is it the assignee, everything they have commented on) there are a lot of limitations to this
      2. use the advanced search in confluence but i don't think you can export that information
   3. Everything with a specific keyword
      1. This will be extremely difficult but Advanced search in both cases
4. What file format would these exports use?
   1. Most likely CSV for jira, XML for confluence