Audit log retention in Jira/Confluence — does the built-in window actually cause problems?

Marketplace General Discussion
1

I’m looking at building a small Forge app around audit/permission history, and before I
write any code I’d like to understand whether the problem I think exists is real.

As I understand it, the built-in audit log keeps roughly 180 days in Jira and up to
12 months in Confluence, with longer retention available on Enterprise. The official
guidance for keeping records longer is to export them and store them elsewhere.

The idea I’m considering is deliberately narrow:

  • Records only permission changes and deletions — not every event
  • Keeps them inside your Atlassian site, beyond the built-in retention window
  • List view and CSV export. No dashboards, no alerting, no SIEM integration

What I can’t tell from the outside is why this space is so small. Existing audit apps
have relatively few installs compared to other categories, which could mean any of:

  1. Nobody actually needs retention beyond the built-in window
  2. The built-in log is good enough for the cases that matter
  3. Organizations that need it are on Enterprise anyway, so the gap never appears
  4. People need it but solve it another way (scripted exports, external tooling)

If you’ve had to answer “who changed this permission, and when?” for an audit or an
incident — did the built-in log cover you? If it didn’t, what did you do instead?

I’m genuinely trying to find out whether this is worth building, and “it isn’t” is a
useful answer.

2

Your two numbers hold up. Option 3 is the one I’d throw out.

Guard and Enterprise change what the org log at admin.atlassian.com records, not how long it keeps it. On Guard Standard alone the Jira and Confluence app admin logs don’t reach that log at all, per the plan table; you need Guard Premium, Cloud Enterprise, or Guard Standard plus Cloud Premium before those events land there. And the upgrade isn’t retroactive, the page says it “doesn’t recover events from before you upgraded”.

So the orgs you’d assume are already covered are covered forward only, from the day they paid.