Skip to main content

Introduction

Sensitive Data Scanner helps enterprises discover sensitive data in Jira Data Center before migration, audit, or security review - without modifying Jira content, exporting raw Jira data, or persisting raw sensitive values.

Why scan before going cloud?​

Once your Jira content is migrated to the cloud, cleaning up leaked secrets, credentials, and personal data is much harder - and may already be a compliance incident. Sensitive Data Scanner runs inside your own infrastructure and shows you exactly where sensitive data lives in your issues, fields, and comments while you still have full control.

What it does​

  • Scans Jira Data Center content - issue fields, comments, and optionally attachment contents - with 75 built-in rules plus your own custom rules, covering secrets, credentials, and personal data.
  • Reads exclusively through the Jira REST API using a service account. No Jira plugin, no direct database access.
  • Never modifies Jira content: no edits, no comments, no deletions, no redaction.
  • Stores nothing derived from the matched text - only a keyed fingerprint, a source locator, and rule metadata. Raw sensitive values are never persisted, exported, logged, or displayed.
  • Provides a review workflow (false positive / accepted risk / fixed), suppression of known-safe matches, dashboards, CSV export, and a full audit trail.
  • Runs scans on a schedule and mails periodic finding summaries to Jira project leads, so risk stays visible without anyone logging in.

How it is deployed​

Sensitive Data Scanner is not a Jira Marketplace app. It ships as a Docker-based external web application (Angular UI + Spring Boot backend + background scanner workers) with offline license validation. Sign-in is handled by your own OIDC identity provider (for example Keycloak).

Nothing leaves your network: no phone-home, no cloud AI, no telemetry. See Security and Data Handling.

Continue with Requirements and the Quick Start.