Attachment Policy Guard documentation

Availability and installation

Attachment Policy Guard is awaiting Atlassian Marketplace review and cannot be installed by the public today. After approval and listing, open its Marketplace listing, choose Get it now, select your Jira Cloud site and review the permissions Atlassian presents before confirming. Marketplace licensing terms will be shown on the listing.

Requirements and permissions

• Jira Cloud and permission to install apps on the site. Only Jira administrators can open and change the app's settings page.
• The submitted Forge manifest declares read:jira-work to read attachment and work item data; write:jira-work to remove a matching attachment in licensed enforce mode and optionally add a note; storage:app for policy, processing locks and audit entries; and report:personal-data for weekly account-ID reporting to Atlassian.
• An active Marketplace licence is required for deletion. Without one, the app does not remove a flagged attachment.

Set up an attachment policy

• Open Jira settings, then Apps, then Attachment Policy Guard.
• Choose the file types to allow or block. You can set a site policy and project-specific overrides.
• Keep report mode on first. Review the audit log to see which new attachments match the policy.
• If the results are expected and the site has an active licence, an administrator can select enforce mode and confirm the change. Choose whether the app should add a note when it removes a matching attachment.

What happens to a new attachment

• Jira accepts the upload and emits an attachment-created event; this app does not block the upload before that event.
• The app reads attachment metadata and the first 4 KB of file content when available. For files no larger than 4 KB it reads the whole file. The bytes are used in memory to check file type and are not saved.
• Allowed files are left alone. A matching file is recorded in report mode; licensed enforce mode removes it and can add the configured note.
• Administrators can review matching entries in the audit log and export a CSV.

Data and retention

• The app runs on Atlassian Forge, declares no external network permission and operates no Atesen Software server. It does not send attachment contents outside Atlassian or store them.
• Atlassian-hosted app storage contains policy settings and, for matching attachments, an audit entry with the file name, size and MIME type, file-type decision, project/work item identifiers, uploader account ID, action and timestamp.
• Audit entries use a 90-day storage TTL. Processing locks contain the attachment ID and expire after two days. A weekly task reports stored account IDs through Atlassian's Personal Data Reporting API. See the privacy page for the full details.

Questions and known limits

Can it prevent an upload? No. Jira raises the event after accepting a new attachment, so enforce mode removes a matching file after that event is processed.

Is this antivirus? No. The app checks configured file types and signatures; it does not scan files for malware.

Does it check old attachments? The app processes attachment-created events; it does not run a bulk scan of existing files.

Why was a file only reported? New policies start in report mode. Deletion requires an administrator-confirmed enforce mode and an active Marketplace licence.

Where can I ask for help? Use the support page linked below. Do not send credentials, API tokens or attachment contents.

Demo video plan (script only)

A 75-second scene-by-scene demo script is available. No recording is included or claimed.

Open the Attachment Policy Guard demo script

Publisher and product names

Attachment Policy Guard for Jira is published by Atesen Software, an independent third-party Marketplace vendor. Jira is an Atlassian product name; this product is not made, sponsored or endorsed by Atlassian.