Jira Governance FAQ & Licensing

1. Licensing & Billing Mechanics

How does the 1 - 10 user free tier work?

Every app in the Asymm Systems Jira Governance Suite is free for Jira sites with up to 10 users. The free tier is not a trial: it has every feature of the app and no time limit, and you do not need a credit card.

How is billing calculated for larger instances?

Billing is managed directly by Atlassian via your standard Jira Cloud invoice. Atlassian Marketplace licenses apps based on the user tier of your Jira Cloud instance (e.g. a 50-user Jira instance requires a 50-user app tier). Each app has its own price per user per month:

1 - 10 Users: free for every app.
CascadePlan: $1.50 for 11 - 100 users, $1.20 for 101 - 250 users, $0.90 for 251 - 1,000 users.
FourRealities: $1.40 for 11 - 100 users, $1.10 for 101 - 250 users, $0.80 for 251 - 1,000 users.
DefinitionGuard: $0.95 for 11 - 100 users, $0.75 for 101 - 250 users, $0.24 for 251 - 1,000 users.
LedgerSeal: $0.95 for 11 - 100 users, $0.75 for 101 - 250 users, $0.24 for 251 - 1,000 users.
Above 1,000 Users: the same price as for 251 - 1,000 users, for each app.

Do you offer annual payment discounts?

Yes. Annual billing through Atlassian Marketplace costs 10 times the monthly price: you pay for 10 months and get 12.

Can I purchase apps individually, or do I need the whole suite?

Each app (LedgerSeal, DefinitionGuard, FourRealities, CascadePlan) is published as an independent Atlassian Marketplace app. You can install only the specific capabilities your compliance framework demands (e.g. LedgerSeal for change control seals), or deploy all four to establish an end-to-end zero-trust governance layer. FourRealities alone uses the checks it can make on your site (Intent, and Code when your Git integration fills the Development field); Process and Audit show Not used on this site and are not scored until DefinitionGuard or LedgerSeal is in use.

2. Architecture & Data Residency

Where is customer data stored?

All application data (cryptographic hashes, seal records, DoD checklist items, and plans) is stored only in Atlassian Forge storage for your installation, and some of it as Jira issue properties, remote links and comments on your own site. Data residency follows Atlassian's rules for Forge apps.

Does any data leave our Atlassian perimeter?

No. Every app in the suite declares zero outbound egress endpoints in its Atlassian Forge manifest. We operate no external SaaS backends, databases, or API proxies. All hashing, signing, and verification logic runs on Atlassian Forge. The apps call only the Jira and Confluence APIs of your own Atlassian site.

Are Asymm Systems apps Cloud Fortified?

No. The apps are not Cloud Fortified. They are built on Atlassian Forge with no external egress, and their data stays in Atlassian Forge storage.

What personal data do the apps store?

CascadePlan stores Atlassian account ids only: of who froze a baseline, of who requested or reviewed a scope change, of each person who works on a task through a Jira sub-task, and of the Jira administrator who last saved the approver groups. It reports them each week to Atlassian's personal data reporting service and removes the id of a closed account.

The other three apps store Atlassian account ids to record who did each action: LedgerSeal of who sealed, signed or revoked a seal (as pseudonymous tokens, with no display name), DefinitionGuard of who ticked, waived or configured a Definition of Done item (as pseudonyms, reported each week to Atlassian, with the link to a closed account deleted), and FourRealities of who requested or decided a Code exception, who gave a rework reason, and the assignee for the "My issues" filter. The privacy policy lists what each app stores.

3. Support & Incident SLAs

How do I obtain technical support?

Every user of the apps, on the free tier or a paid tier, gets the same support, as the support page states:

Support Email: [email protected]
Response SLA: A first answer within 24 business hours (Monday through Friday) for general questions and defects; within 4 hours for a defect that blocks your production work.
Security Issues: Report vulnerabilities directly to [email protected] (acknowledged within 72 hours).