Is JIRA data encrypted?

[Andreas Moormann]

Hello everybody,

we want to use JIRA software & service desk on one of our servers.
Is the data that is created within or uploaded to JIRA (e.g. tickets, files) encrypted on the server's hard disk?

Thanks for your help in advance!

Best regards,
Andreas

[Bastian Stehmann · Accepted solution]

Hi @Andreas Moormann,

Jira stores the data in a database. Passwords for example are encrypted, content for issues is not encrypted. Attachments are stored in the filesystem, they are also not encrypted.

[Nic Brough -Adaptavist-]

Actually, passwords are not encrypted, they're salted and hashed, but that's a technical quibble.

It is possible to use encrypted databases and file-systems, but the software itself does not do it, it relies on the database and operating system to do the work when you need it.

[Andreas Moormann]

Hi @Bastian Stehmann, @Nic Brough -Adaptavist-

Thank you both for the clarification!

[Justin Wilson]

In case you need a more fortified solution, 

We are an Atlassian Solution Partner and had a lot of requests to strongly protect specific data (file attachments or extra-sensitive fields) and limit access to specific groups/individuals.

As of July 2020, Team Secrets is the only add-on which can also handle Service Desk portal request screen attachments & encrypt them with 2FA in this way (new functionality) - please check it out if it suits your organization's needs

https://marketplace.atlassian.com/apps/1216894/encryption-security-2fa-for-jira?hosting=server&tab=overview

[Yannic De Baets]

Hello Justin,

Seems like a good solution, but i have a question: can you also edit a "secret" that was saved/published before, so do a edit or update of the saved/published secret? (after testing your solution, i'm not sure that is available, hence my question).

Thanks for your info,

Regards, Yannic

[Justin Wilson]

Hello Yannic, 

Not at the moment, though this is on our roadmap.

We support two types of "secrets": files & text. 

Editing doesn't seem to make sense with encrypted files as you'd simply upload a new replacement files since graphic, video, or office document formats cannot be directly edited in Jira. If there is an interesting use case for editing though, we'd love to know about it. 

For secure text fields, it does make sense since you'd directly modify the text in Jira and save the changes.

We're planning to first add support to edit ownership and share settings. Second we'll add support for direct secure text edits. 

Regards. 

[Dan Ivory]

Hi @Andreas Moormann,

Perhaps a bit late to this, but our app Encryption for Jira should help you if you need to encrypt attachments and text fields (using E4J's Encrypted Custom Field). This will encrypt your data in your database and file-system.

Hope that helps,

Dan

[Yannic De Baets]

Hello Dan, 

Is this solution also available for Jira Cloud (or is it not neede there since all is already encrypted)?

Thanks for your info,

Yannic