Skip to main content

Requirements

Infrastructure​

  • Docker with Compose v2 - the scanner ships as a single container image (UI + backend + scanner workers), published on Docker Hub as arcsoftklg/sensitive-data-scanner. See Production Deployment.
  • PostgreSQL for any production installation. The scanner creates and migrates its own schema; you supply an empty database and a user that owns it. Without it the scanner falls back to an in-memory database and loses everything on restart - see Production Deployment.
  • Network access from the scanner host to your Jira Data Center base URL (HTTPS recommended) and from users' browsers to the scanner host.
  • An OIDC identity provider (for example Keycloak) reachable by both the scanner backend and users' browsers. See Identity Provider.
  • An SMTP server, only if you want periodic e-mail summaries sent to Jira project leads. See Reporting.
  • A reverse proxy terminating TLS in front of the container, which serves plain HTTP on port 8080.

The scanner needs no internet access. Its only outbound connections are to Jira, your identity provider, your database, and - optionally - your SMTP server.

Jira​

  • Jira Data Center, newest major version. The connection test verifies the version. Jira Cloud is not a scan target; the point is to scan before you migrate.
  • A Jira service account for the scanner with at least the Browse Projects permission on every project you want to scan. The scanner only reads through the Jira REST API; it needs no Jira administrator rights.
  • For reporting: grant that service account the Browse users and groups global permission and configure Jira's User email visibility as Logged in users only (recommended) or Public. There is no special project role. Hidden or Masked addresses cannot be used as report recipients. See Jira Connection.

Sizing​

  • 2 vCPU and 2 GB of heap handle the default scan engine settings comfortably.
  • Attachment scanning is the memory-hungry part; budget more if you enable it.
  • Database growth follows the number of issues in scope. The configurable retention window caps it, at ten years by default; audit events are kept indefinitely unless you opt in to purging them.

License​

  • No licence file is needed to start. An installation with none runs a five-day evaluation covering 1000 issues per scan, on a single worker, without reading attachment contents. See Quick Start.
  • Yearly licences are signed offline license files, issued per scanner installation and not tied to the configured Jira base URL. See License and Pricing.
  • Reading attachment contents additionally requires the SCAN_ATTACHMENTS license feature.