Documentation

Velum Privacy finds personal data in Jira and Confluence, masks it reversibly, and erases it on request. It runs entirely on Atlassian Forge, inside your own tenant. This page explains how to install, configure and operate it.

Install

Velum Privacy installs into Jira first, then optionally connects to Confluence. From the Atlassian Marketplace, choose Get it now and follow the prompts. Jira administrator permission is required to install and to open the dashboard.

After installation, open the dashboard at Settings, Apps, Velum Privacy in Jira, or Settings, Velum Privacy in Confluence.

Operating modes

Velum has three modes, set on the Overview tab:

• Off. All scanning is paused. No content is scanned or changed.
• Monitor. Velum detects and reports personal data but never edits content. This is the default and the safe way to see what is in your instance before acting.
• Protect. Velum detects and, per your remediation policy, auto-masks new high-severity findings as they appear. Masking is reversible.

Start in Monitor. Move to Protect once you have reviewed what Velum finds and configured the remediation policy you want.

What is detected

Two tiers run together:

• Structured detectors (regex, always on, high precision): payment cards, IBANs, national IDs for Spain, the US, the UK, France, Germany, Turkey and Italy, plus API keys and tokens (AWS, GitHub, OpenAI, Slack, JWT).
• AI detection (an on-device multilingual model): names, organisations and locations. Broader coverage than the structured detectors, with more false positives. It can be turned off if you only care about structured data.

Detection covers Jira issue summaries, descriptions, comments and attachments, and Confluence page bodies, comments and attachments. Attachments are scanned for PII but are never modified; they are reported only.

Findings

The Findings tab lists every detection with its type, severity, location and status. Filter by severity, then act on each finding in place:

• Mask replaces the detected values with reversible tokens, preserving the document's structure, headings, tables and macros.
• Unmask restores the original values from the stored reversal key.
• Dismiss or Reopen manages a finding's status without editing content.

Bulk actions apply the same operations across a selection. Actions on content in a product you do not administer are skipped and reported, not silently applied.

Reversible masking

Masking replaces a value such as maria@example.es with a token such as ⟦EMAIL_1⟧, and stores an encrypted mapping so the original can be restored. The mapping is encrypted with AES-256-GCM at the application layer. Masking never flattens a document: only the text of the detected values changes, and unmasking returns the content byte for byte.

GDPR Article 17 erasure

The GDPR erasure tab implements the right to erasure. Search a data subject by name or email to find every match across Jira and Confluence, generate an audit-ready PDF report as evidence, then erase.

Erasure is different from masking, and irreversible by design. It redacts the values in the content itself, deletes the copies Velum stored, and destroys the reversal keys for those locations. Once erased, the values cannot be recovered.

Settings

The Settings tab controls what is scanned and what happens automatically:

• Scan triggers. Real-time scanning checks each issue and page as it is created or edited. A scheduled scan sweeps in-scope content on a cycle to cover the backlog that existed before Velum was installed.
• Scope. Scan the whole instance, or restrict to specific Jira projects and Confluence spaces to reduce noise and usage.
• Detection. Toggle the AI name detector, comment scanning and attachment scanning, and turn off individual detector types (for example, the location detector, which is the least precise).
• Remediation. Enable auto-masking (Protect mode only), set the severity threshold at which it acts, and choose instant or deferred masking. You can also label high-severity Jira issues so your own Automation rules can react.

Permissions

Velum Privacy requests only the scopes its features need. Content read scopes are used to scan; content write scopes are used only when you or your policy remediate. Confluence administrator status is detected by reading a single admin-gated record, which is then discarded. App storage holds findings, the audit log, policy and the reversible token mappings, all inside your tenant.

For the full per-scope justification and the security architecture, see the Security page.

Support

Raise bugs, feature requests and support questions through our support portal at su-engineering.atlassian.net, or email support@su.engineering.

Other Velum products

Everything above documents Velum Privacy for Jira and Confluence, the app you reached this page from. Velum is one detection-and-masking engine delivered across several surfaces, so your people are covered wherever they touch AI. The rest are summarised here; full guides live with each product.

Browser extension (Velum Lite)

Masks and unmasks beside any web AI, including Claude, ChatGPT and Gemini, or from a Mask button placed in the page on sites you grant it. Drop a PDF, DOCX, TXT, RTF, CSV or Markdown file to get a masked copy back. It runs fully offline in the browser and can pair with the desktop app to borrow its stronger engine. It installs from the Chrome Web Store, which is the only route we distribute it through.

Desktop app (macOS)

A native app for staff who work with sensitive files all day. It masks pasted text, dropped files and whole folders at the highest detection tier, and keeps an encrypted local mapping so masking is reversible across sessions. A Protection page states the app's own network behaviour and exports a one-page protection receipt for a DPO. The full model is an optional one-time download; nothing else leaves the machine. Free for seven days with no account, then one licence key keeps masking on.

CLI and library

Drop-in velum mask and velum unmask for scripts, data pipelines and developer workflows. The same engine as every other surface, callable from the terminal or imported as a library, with no network calls at runtime.

Embedded loopback service

A local HTTP endpoint any internal application can call to run its own AI pipeline through Velum. Send text to POST /mask before it reaches a model and POST /unmask on the reply. The service binds to 127.0.0.1, and its mappings are held in memory only and expire, so nothing sensitive is written to disk. This is how you protect the AI you build, not just the AI you buy.

For the whole picture across every surface, see the product brief at velumprivacy.com.