End to End Encryption

[Islam Bahnasy]

Does Jira and other Atlassian products provide End-to-End encryption on their servers? meaning that data only gets decrypted on the client side and Atlassian cannot access this data?

[Dirk Ronsmans]

Hey @Islam Bahnasy ,

On the Atlassian Trust Center you can find the information you are looking for.

https://www.atlassian.com/trust/security/security-practices#encryption-of-data

[Islam Bahnasy]

Thanks for your reply but I'm not asking about data transfer as it's of course using TLS session, and not about disk encryption.

But I mean End-to-End where data is only decrypted in the client side (the browser) and remains encrypted on the server which means that Atlassian employees cannot access it in plain text.

[Rupert Jung]

Yes, I was also wondering why this isn't supported. 

• Enter key in browser
• Save hash of key in cookie
• Use this key to encrypt and decrypt all loaded data directly within the browser (javascript or webassembly)
• Key does never leave the browser

THAT would be real security.

[Metin Savignano]

The contents of cookies are supposed to be sent to the server, so that won't work.

However, I get your idea, yet that doesn't work for structured data that needs to be processed by the server app (like for indexing, referencing, searching).

[Rupert Jung]

Yes, maybe the local storage may be a better idea or just save the secret on a secure place within the browser.