How does Document Vault for Jira Cloud secure attachments?

Document Vault adds a secondary attachment panel to each Jira Cloud issue that is hidden from users outside a configured access list. Attachments uploaded to the Vault are only downloadable by users in the permitted groups, project roles, custom user fields, or the issue's reporter/assignee. Everyone else sees nothing -- not even the file names.

Who can see attachments in Document Vault for Jira Cloud?

Access is configured in the Admin Document Vault page. You can grant full access (view, upload, edit, delete) or read-only access to specific user groups, project roles, single or multi-user custom fields, single or multi-group custom fields, or to the issue's Reporter, Assignee, or Creator. Users outside these lists see no Document Vault content.

What is the file size limit for Document Vault Cloud attachments?

Document Vault for Jira Cloud has a 50 MB per-file limit on attachments. This matches Atlassian's Forge platform constraint. Multiple files can be uploaded in one operation by selecting or dragging several at once; if a comment is provided during a multi-file upload it is applied to every file in that batch.

Where are Document Vault Cloud files stored?

All Document Vault data and files are stored inside your Jira Cloud instance. Nothing is sent to Redmoon Software servers or to any third-party service. The plugin uses Atlassian Forge storage, so files stay within Atlassian's infrastructure and inherit the same data residency and compliance posture as the rest of your Jira data.

Can I add comments without an attachment in Document Vault?

Yes. Document Vault supports standalone comments that have no associated file. Open the Document Vault panel and click the comment icon to add a comment that is visible only to users with Document Vault access. This is useful for recording confidential context against an issue without attaching a document.

Document Vault Cloud | Redmoon Software

User Guide

Hide your attachments. Document Vault offers a secure attachment repository that can be hidden from all but a select user group.

Limitations: Document Vault for Jira cloud has a 50mb file size limit for attachments.

Data and File Storage: All data and files are stored within Jira. No information or files are stored on Redmoon Software servers

Document Vault on Issues

On an Issue, the Document Vault panel is displayed below the description on an Issue.

If the Document Vault panel is not shown then you will need to click on Apps -> Document Vault, as shown below

The Document Vault panel allows you to add attachments, with or without a comment, and standalone comments. The attachments and comments are only visible to users authorised from the Admin Document Vault configuration page (see below).

Clicking on the attachment’s name will download the attachment. To the right-hand side of each attachments details, are four buttons for updating the attachment, editing the comment, deleting the comment and viewing details about the attachment, including its comment.

Adding Attachments

Attachments can be added by clicking on the “+” button. This will open up the Attach File dialog shown below.

Users can upload multiple files simultaneously by using Select File button or dragging and dropping the files in.

Please note that if a comment is provided during a multi-file upload, the same comment will be applied to all selected files.

Once one or more attachments are added, click the Attach button. The files will be uploaded into Jira. Note all attachments are stored in Jira and not on external servers.

Update Attachment

Updating an attachment will replace the current version with a new one. The updated attachment does not need to retain the same file name.

To update an attachment, click on the icon featuring a downward-pointing arrow located on the right side of the attachment. This action will open the dialog box displayed below. Additionally, you can edit the comment at the same time.

Edit Attachment Comment

An attachment has an optional comment that can be shown (only if present) by clicking on the attachments details button (the last of the four icon buttons in the main Document Vault panel). The comment can be edited or created (if it doesn’t already exist) by clicking on the pencil icon, the second of the four icon buttons on the main Document Vault panel.

Delete Attachment

An attachment can be deleted by clicking on the trash bin icon, the third of the four icon buttons in the main Document Vault panel. You will be prompted to confirm the deletion, after which the attachment will be permanently removed.

Standalone Comments

Document Vault has a section for standalone comments on the main Document Vault panel.

Clicking on the comment icon, at the top of the Document Vault panel, will open the following dialog.

Admin Configuration

The admin Document Vault page allows an administrator to specify:

The storage project for Document Vault attachments
Which user groups/project roles a user must belong to before they can use the full access to Document Vault functionality
Which user groups/project roles a user must belong to before they can use the read-only access Document Vault functionality
What types of file extension in the respective fields to use
Send email notifications when a file is attached to Full access users, Read-only access users and/or the Issue assignee
Activate Document Vault for all projects or individual projects
Customize the message displayed when a user does not have permission to see Document Vault attachments and comments

Storage Project

Document Vault uses a secure project within your Jira instance to store all attachments, ensuring that no attachments or data are stored on Redmoon Software servers. This keeps all your files safely within your Jira environment.

To maintain security, the storage project should be restricted to the smallest possible number of users and notifications should be turned off for the project. Anyone with access to this project will have access to all Document Vault attachments, so it’s critical to limit permissions accordingly.

Note: The storage can not be changed once it has been set.

Full Document Vault functionality to Users to the following groups/roles

Specify which user groups and project roles a user must belong to before they can see and use all the functionality of Document Vault. If both the user group and project role access fields are empty then no one will be able to add/edit/delete attachments and comment in Document Vault. The Document Vault panel in Issues shows regardless of whether a user has access to Document Vault but none of the attachments and comments are visible unless the user is in one of the specified user groups, project roles or have read-only access.

Read-only access to Document Vault functionality to Users with the following groups/roles

Specify which user groups and project roles a user can belong to so they can see Document Vault information and/or download attachments. If both the user group and project role access fields are empty then no one will have read-only access to use Document Vault. The Document Vault panel in Issues shows regardless of whether a user has access to Document Vault but none of the attachments and comments are visible unless a user belongs to one of the user groups or project roles in the full or read-only access sections.

File Extension Filtering

You can specify the file extensions that a file can or can’t have. For excluded extensions, list the file types that attachments must NOT have (e.g., zip, jar, doc). For included extensions, list the file types that attachments must have (e.g., gif, png, jpg).

Note: Don’t specify both include and exclude extensions

Notifications

When an attachment is added, you can notify the users that are in the full access user groups, read-only access user groups, or the assignee of the issue.

Only Activate in Projects

By default Document Vault is available to user, with the right access, all projects. The ‘Only Activate in Projects’ checkbox, if checked, allows you to only activate Document Vault in particular projects. Once this is checked you need to also check the ‘Activate for this Project’ checkbox in the projects configuration page (see below for more details).

Custom Document Vault Not Available Message

With this field, you can specify a custom message to be displayed for users who don’t have access to Document Vault.

Because of constraints in the Jira development platform we use, the Document Vault panel is available to everyone. If a user doesn’t have access to the attachments and comments (through group and project role access), they will be shown a message saying that they do not have permission to see Document Vault attachments. This field allows you to customize that message

For example, if users that don’t have access to the Document Vault attachments complain that they should have access then you could customize the message to “No attachments found”. This would give them the impression that they have access but there is no attachments.

Another example is if users can request to see the Document Vault attachments then the message could say “You do not have access to these attachments. If you need access then please contact your Jira administrator.”

Project Configuration

Document Vault also has a project configuration page. This can be viewed by going to a project, as a project or Jira admin, and selecting Project Settings and then, under Apps, clicking on Document Vault.

For Project Configuration, there is only one option, and this is only shown if “Only Activate in Projects” is checked on the global configuration page. If “Only Activate in Projects” is checked, Document Vault will only be available in Projects where ‘Activate for this Project’ is also checked.

Note: For further information, please refer to the “Only Activate in Projects” section of the global configuration page.

Cloud

Data Center