Zero-Trust Governance & Change Control for Jira Cloud
The comprehensive compliance and delivery integrity platform for Jira Cloud. Cryptographic approval seals, enforceable Definition of Done, delivery evidence across four realities, and fast dependency-driven planning, built entirely on Atlassian Forge.
The Unaddressed Native Problem
In regulated industries (FinTech, HealthTech, MedTech, and SOC 2 Type II / ISO 27001 organizations), software releases must satisfy strict compliance and change authorization criteria. While Jira Cloud provides issue tracking and audit logs, native Jira leaves four critical governance gaps:
1. The Approved Ticket Problem
Jira records that an edit occurred in history, but cannot verify whether ticket acceptance criteria or attachments were modified after management approved the release. Permission schemes cannot block edits without freezing the entire project.
2. The Ungated Done Gate
Native checklists operate on the honor system: assignees tick their own boxes without required evidence, without a rule that someone other than the assignee checks certain items, and without audited waivers before moving issues into Done.
3. The Disjoint Realities
Design decisions in Confluence, Jira workflow status, and pull requests drift apart during execution. Native Jira does not show, issue by issue, which of these has evidence and which does not.
4. The Rigid Timeline
Timeline tools often support only finish-to-start dependencies, write estimates to Jira that nobody entered, and do not explain why a task starts when it does.
The Four Governance Pillars
The Asymm Systems Jira Governance Suite delivers four specialized, interoperable apps designed to turn Jira Cloud into a zero-trust compliance engine:
LedgerSeal
Cryptographic Approval Seals & Post-Approval Change Control. Computes SHA-256 snapshot hashes of covered fields, comments, and attachments. Enforces separation of duties, Ed25519 digital signatures, and workflow transition gates. Includes an open-source offline verifier.
DefinitionGuard
Enforceable Definition of Done as Code. Replaces honor-system checklists with per-issue-type DoD criteria, required evidence (a link or a note), items the assignee may not tick, audited waivers, and a workflow gate into Done. The hash-chained history can be copied as JSON.
FourRealities
Delivery Integrity Across Four Realities. Checks each issue for evidence in four realities: Intent (a linked Confluence page or decision issue), Process (a DefinitionGuard Definition of Done, signature verified, or a Checklists for Jira checklist, shown but never counted as evidence), Code (pull requests in the Jira Development field) and Audit (a LedgerSeal seal). Shows a Reality Alignment Index (RAI) per issue and project, and counts rework loops. Checks your site does not use are not scored.
CascadePlan
Fast Timelines with Percent-Trigger Dependencies. A canvas timeline for Jira where a task can start when its predecessor reaches a set percentage. CascadePlan explains why each task starts when it does, previews every Jira write before it happens, and offers undo, a Changes panel, keyboard control and a table view.
Zero-Egress Architecture Guarantee
Every application in the Asymm Systems Jira Governance Suite is engineered from the ground up as a 100% Atlassian Forge Native solution. We believe compliance software should never introduce new vendor attack surfaces:
| Security Property | Asymm Systems Implementation | Enterprise Benefit |
|---|---|---|
| Network Egress | No external egress is declared in any of the four Forge manifests. LedgerSeal has an automated test that checks this. | The apps send no ticket content, usernames, or summaries outside Atlassian. |
| Data Persistence | Persisted in Atlassian Forge storage for the customer's installation, and as Jira issue properties on the customer's own issues. | App data is stored by Atlassian in Forge storage, under Atlassian's data residency rules for Forge apps. |
| Compute Isolation | Runs on Atlassian Forge compute. | Asymm Systems operates no backend servers, databases, or API infrastructure. |
| Cryptographic Execution | SHA-256 snapshot hashing, canonical JSON serialization, and Ed25519 signatures run on Forge compute. | No AI models and no external cryptographic services are involved. |
| Offline Verification | Open-source standalone Node.js verifier using only standard library node:crypto. | Auditors can check the evidence offline, with no access to Jira or to the app. A pass shows the evidence was not changed after export and was signed with the published key. |
Pricing & Packaging
Each app is sold on its own through Atlassian Marketplace billing, per user per month. Each app has its own price.
- 1 to 10 users: free, with every feature of the app.
- Above 1,000 users: the same price as for 251 - 1,000 users.
- Annual billing: 10 times the monthly price. You pay for 10 months and get 12.
| Price per user per month | 11 - 100 users | 101 - 250 users | 251 users and more |
|---|---|---|---|
| CascadePlan | $1.50 | $1.20 | $0.90 |
| FourRealities | $1.40 | $1.10 | $0.80 |
| DefinitionGuard | $0.95 | $0.75 | $0.24 |
| LedgerSeal | $0.95 | $0.75 | $0.24 |
Every tier, including the free tier, gets the same support. The support page gives the response times.
Documentation & Compliance Resources
User & Admin Guides
Comprehensive operational documentation, installation steps, and workflow configuration walk-throughs for each app.
View User GuidesCompliance Mappings
Detailed regulatory alignment matrices for SOC 2 Type II CC8.1, ISO/IEC 27001:2022 A.8.32, and FDA 21 CFR Part 11.
View Compliance MappingOpen Offline Verifier
Zero-dependency verification tool and public verification keys for independent offline auditor validation.
Verifier DocumentationPricing & Architecture FAQ
Common questions regarding Atlassian licensing tiers, Forge data residency, and support response SLAs.
Read FAQ
Eliya 
Dial