pii protection & dlp for jira and confluence

Velum is an Atlassian Marketplace app that finds, masks, and erases personal and sensitive data across Jira issues and Confluence pages — combining a high-precision regex engine with a multilingual AI model, and running entirely on Atlassian Forge so your content never leaves your instance.

marketplace listing →privacy policy →support@su.engineering →

what it detects

Two detection tiers run together, both on-device inside Forge — no content is sent to any vendor or third-party AI service.

tier-0 · regex

High-precision structured PII: emails, phone numbers, IBANs, credit cards, IP addresses, secrets (AWS / GitHub / OpenAI / Slack / JWT), and national IDs for ES, US, UK, FR, DE, TR, IT.

tier-1 · NER

A multilingual transformer model catches people, organizations, and locations that patterns miss — the contextual PII most English-first scanners overlook.

what it does

Reversible tokenization — replace PII with consistent ⟦TYPE_N⟧ tokens; authorized admins can restore the original, so data stays usable but protected.
Real-time & scheduled scanning — scan on issue/page create and edit, plus background batch scans.
Policy-driven remediation — auto-mask high-severity PII, and apply native Jira labels your Automation rules can trigger on.
Attachment scanning — extract and scan text from PDF and text-based attachments, in-instance.
GDPR Article 17 erasure — look up a subject by name or email, find every match across Jira and Confluence, remediate, and export an audit-ready PDF.
Immutable audit log — who did what, when (no PII surfaces stored).

operating modes

Off — pause all scanning.

Monitor — detect and report; never edits content. Remediate manually.

Protect — detect and auto-remediate per your policy.

getting started

Install Velum to Jira and/or Confluence from the Atlassian Marketplace.
Open Settings → Apps → Velum PII (Jira) or Settings → Velum PII (Confluence).
Create or edit an issue/page with sensitive data — Velum scans it automatically.
Review findings, set your policy in the Settings tab, and remediate.

how it's built

Velum runs entirely on Atlassian Forge. Detection executes inside the Forge function; findings and the encrypted reversal mappings live in Forge storage inside your instance. The only outbound request downloads the public AI model file from the Hugging Face CDN (inbound weights only — no customer data leaves your instance). See the privacy policy for the full data model.

pricing

Free for teams up to 10 users (standard Atlassian Cloud policy), then per-user monthly pricing that decreases as your team grows — anchored below comparable data-protection apps. A 30-day free trial applies. Exact tiers are shown on the Marketplace listing.

faq

Does my data leave my instance?

No. Only the public AI model file is downloaded (inbound). No customer content is sent anywhere.

Which languages are supported?

Structured PII across ES / US / UK / FR / DE / TR / IT; NER (person / organization / location) is multilingual.

Is masking reversible?

Yes — by a Jira administrator, via the stored encrypted mapping. De-anonymization is admin-gated.

Who can de-anonymize or remediate?

Only Jira administrators. All sensitive actions are permission-gated and audit-logged.

support

Email support@su.engineering — target response within 24–48 hours for enterprise requests.