FileWarden
Attachment governance for Jira

For most policy decisions, no - it governs by filename, declared MIME type, size, count, and duplicates. As an optional Pro layer, FileWarden runs a content scan inside text, PDF, Word, Excel, and PowerPoint files, looking for leaked secrets and PII such as AWS keys, private keys, GitHub, Slack and Google tokens, JWTs, credit cards, US SSNs, and IBANs. The scan runs on Atlassian with zero external egress, and the matched value is never shown or logged. There is no antivirus engine and no OCR, so an image-only or encrypted document is treated as unreadable rather than as a match.

Inside text, PDF, and Office files (Word, Excel, PowerPoint) it matches common leaked-credential and PII patterns: AWS access keys, private key blocks, GitHub personal-access and OAuth tokens, Slack tokens, Google API keys, JSON Web Tokens, high-entropy secret assignments, credit card numbers, US Social Security numbers, IBANs, and email addresses. It runs entirely on Atlassian Forge and never shows or logs the matched value - only that a match was found.

Yes. Portal and email attachments are checked like any other issue, so a customer can't slip an executable, a leaked secret, or an oversized dump into your service desk queue.

Confluence is a separate Forge installation with no admin page of its own, so it runs the seeded default policy and only that: it blocks executables attached to pages and blogs, moves them to Space Trash where they stay recoverable, and posts a footer comment explaining why. Tuned rules, the secret and PII scan, the signature check, quarantine, per-project and per-group rules, and the grace period are Jira features - if you need attachment governance shaped to your own policy, that is the Jira side of the app.

Yes. Monitor mode logs what would be removed without deleting anything, and a grace period gives uploaders time to fix a violation before enforcement kicks in - so you can prove the policy is right before you switch it on.

By default a violation is removed and recorded in the audit log. On Pro you can quarantine instead of delete, which is reversible: restore the attachment if the block was wrong. You can also run a one-time scan of existing attachments to clean up violations that predate install.

Free includes the global policy, compliance templates, on/off, Monitor mode, the grace period, uploader exemptions, the attachment-count limit and duplicate blocking, the workflow-transition validator, automatic remediation, and the per-issue panel. Pro adds the secret and PII content scan, the signature check for renamed file types, the one-time scan of existing attachments, per-project and per-Jira-group rule overrides, reversible quarantine and restore, the Rovo compliance agent, and the compliance audit log with CSV export and daily digest.

Yes. You can cap how many attachments an issue may hold, and block a file that is already attached - either by filename, or by byte-identical content using a SHA-256 hash computed on Atlassian. Content-based duplicate detection runs on the background sweep rather than at upload, so a large file never delays the attachment.

Yes. Add the FileWarden validator to a transition in a company-managed or team-managed project and the issue cannot move on while it still holds an attachment your policy disallows. The validator fails open - if the app is off, in Monitor mode, or anything errors, the transition is allowed, so it can never wedge a workflow.

Yes. On Pro, the FileWarden Compliance agent in Rovo answers what was removed, quarantined, or flagged over a time window and can author a per-project block rule from the conversation. It is admin-only and every action re-verifies that on the server, so the agent cannot be talked into changing a policy.

No. FileWarden runs 100% on Atlassian Forge with no external egress and no sub-processors - including the content scan, which runs on-platform. Data stays within Atlassian and data residency is honored.

Eight scopes: four for Jira and app storage, four for Confluence. On Jira it reads issues and attachment metadata - and, for the Pro secret and PII scan, attachment content - to apply your policy, removes or quarantines violations, posts the policy comment, and reads an uploader's group membership so rules and exemptions can be scoped by Jira group. On Confluence it reads attachment metadata to block executables and moves them to Space Trash, with a footer comment. Its policies, audit log, and settings live in Forge storage, and everything runs on Atlassian Forge with no external egress.