Verifiable change-control evidence inside every issue

Lacre is an app for Jira Cloud. On every change issue it adds a panel with the project's checklist and a button that seals its state: who checked it, when (in UTC) and a SHA-256 hash of the issue and the checklist. If someone edits the issue afterwards, the panel says so.

It is built for teams that have to show an auditor (ISO/IEC 27001, Spain's Esquema Nacional de Seguridad or a customer) that every change went through its checklist and was approved by the right person, without leaving Jira or keeping spreadsheets.

How it works

1. Check. Whoever carries out the change ticks the checklist items (each tick records who and when), picks the change's risk level and clicks "Seal check".
2. Approve. Someone with an approving role reviews the seal and adds their own. For high-risk changes, the project can require approval before the check.
3. Export and verify. Project administrators export the seals as JSON or CSV, or the evidence sheet of a single seal. Anyone can recompute a seal's hash without Lacre or Jira: how verification works.

The guide explains every step, from installation to the export for the auditor.

What it does not do

• It is not an electronic signature and adds no third-party timestamp: a seal shows that the record has not changed since it was stored and which Atlassian account signed it.
• It does not decide whether an organisation complies with a standard: it provides evidence, and the auditor assesses compliance.
• It does not replace change management in Jira Service Management (change calendar, change advisory board).

Where the data lives

Lacre runs entirely on Forge, Atlassian's app platform, with no servers of its own: seals are stored in the app's storage on Atlassian's infrastructure, and the app sends no data to any outside server. It only asks for the permissions it needs: reading issues and users, writing a copy of each seal to its issue and using its own storage.

Status

Lacre is under development and cannot be installed from the Atlassian Marketplace yet.