Certia Reviews and Details

Most teams preparing for SOC 2 or ISO 27001 run access reviews in a spreadsheet: export users, email managers, chase replies, and hope the auditor accepts the result. Reviewers see names without context, so nearly everything gets approved.

Certia runs the review inside Jira Cloud.

• Complete scope. Certia finds everyone with access through groups, and also people who hold a Jira project role or Confluence space permission directly, which a group-only review misses.
• Context for every decision. Reviewers see each person's groups, roles, last activity, how each piece of access was granted, and what else a group controls before they revoke it.
• AI pre-sort. Each person is tagged likely safe or needs review with a one-line reason, using Atlassian's own Forge LLMs. Names, emails and account IDs are never sent to the model.
• A reason for every decision. Keep, revoke and escalate each require a written note, so the record shows a person actually looked.
• Reminders and escalation. Certia reminds reviewers with pending items daily and alerts the admin when a campaign is overdue.
• Auditor-ready report. A certified report built from an append-only audit log, mapped to SOC 2 CC6.1-CC6.3, with an integrity fingerprint and CSV and PDF export.

Certia runs entirely on Atlassian Forge. Data stays inside Atlassian's cloud, and the app carries the Runs on Atlassian badge.

Certia produces evidence that an access review was performed. It doesn't make an organization compliant on its own, and it records revoke decisions; removing the access is done in Jira.

Free for up to 10 users. Install from the Atlassian Marketplace.