/
Attachment Scanner OCR: User & Admin Guide for Jira Configuration and Usage

Attachment Scanner OCR: User & Admin Guide for Jira Configuration and Usage

Attachment Scanner OCR: User & Admin Guide

A single-page reference for Jira admins installing, configuring, and
operating Attachment Scanner OCR.

What the app does

Attachment Scanner OCR scans Jira attachments for text patterns you
define. It reads images, scanned PDFs, screenshots, Office documents,
CSVs, and text files, and reports every match with file context.
Useful for finding passwords in screenshots, PII in support PDFs,
credit card numbers in spreadsheets, or any custom pattern across
your Jira issues.

Quick start (5 minutes)

  1. Install from the Atlassian Marketplace. Requires Jira
    administrator permissions.

  2. Open Jira → Apps → Attachment Scanner OCR.

  3. Click Create template:

    • Name: Password detection

    • JQL scope: project = MYPROJ AND created >= -30d

    • Pattern type: Simple text

    • Search pattern: password*

    • Scan mode: Full scan

  4. Click Create, then Run scan on the new template.

  5. When the scan finishes, the results page opens automatically.
    Review matches; select offending files and click Delete
    selected attachments to remove them from Jira.

Core concepts

Term

Meaning

Term

Meaning

Template

A reusable scan definition: name, JQL scope, search pattern, and scan mode.

Scan

A single run of a template. Discovers matching issues, processes their attachments, and saves results.

Match

One occurrence of your pattern in an attachment. Stored with surrounding context.

Credit

One unit of OCR work. Image OCR = 1 credit; scanned PDF page OCR = 1 credit. Direct text extraction (Office, CSV, text) = 0 credits.

Scan mode

Full (with OCR, uses credits) or Document-only (no OCR, zero credits).

Tier

Your monthly credit allowance, set by your Marketplace user count.

Creating a template

Open the Scan Templates tab and click Create template.

  • Name: descriptive label.

  • JQL scope: defines which Jira issues to look at. Live-validated.
    Examples:

    • project = HR AND created >= -90d: recent HR tickets only

    • project in (SUPPORT, IT) AND status != Done: open service tickets

    • attachments is not EMPTY: any issue with attachments

  • Scan mode: pick one:

    • Full scan: reads everything, including images and every kind
      of PDF (text, scanned, mixed). Uses one credit per image and per
      OCR'd PDF page; pure text-layer PDF pages and Office / text files
      don't consume credits.

    • Document-only: only Office files (XLSX, DOCX, PPTX) and plain
      text files (TXT, CSV, JSON, MD, …). Images and PDFs of any kind
      are skipped entirely. Costs nothing and never contacts the OCR
      service.

  • Pattern type: Simple text (with * wildcards) or Regex.

  • Search pattern: what to look for. Validated live.

    • Simple: password*, credit card, SSN*

    • Regex: \\b\\d{3}-\\d{2}-\\d{4}\\b (US SSN), \\b[A-Z]{2}\\d{2}\\s?\\d{4} (IBAN-ish)

The pattern is matched case-insensitively against extracted text.

Running a scan

  1. Click Run scan on a template.

  2. The app discovers attachments, processes each one, and saves
    results. Progress shows current file and overall position.

  3. Pause / Resume / Cancel are available while a scan is running.
    Pausing preserves progress; resuming picks up where you left off.

  4. If multiple admins start scans simultaneously, the app queues them
    so each gets a fair turn.

  5. When complete, the results page opens automatically.

Reviewing results

The results page shows:

  • Summary cards: issues scanned, files processed, matches found,
    errors, scan mode used.

  • Mode banner: explains exactly what the scan looked at and what
    it skipped, so a low match count is never misread.

  • Match table: issue key (clickable to Jira), attachment name,
    extraction type (OCR or Direct), matched text, and surrounding
    context.

  • Bulk delete: select rows, click Delete selected attachments,
    confirm, and the files are removed from their Jira issues. Audit
    log captures every deletion.

Scan modes: when to use which

Full scan: choose this when:

  • You need to find sensitive text inside screenshots, scanned PDFs,
    or any PDF (text-layer or mixed).

  • Your team uploads a mix of file types and you want full coverage.

  • You're doing a one-off compliance audit.

Document-only scan: choose this when:

  • Your team's content is primarily Office files and plain-text files.

  • You don't need to scan PDFs (or you'll do those separately with
    Full scan).

  • You want a free, fast, repeatable monthly sweep with zero GPU cost.

  • You've used up your OCR credits but want to keep scanning text content.

Important: in document-only mode, PDFs of every kind are
skipped: even a PDF with a perfectly readable text layer. PDF
extraction currently routes through our OCR-capable service, so
skipping PDFs is what makes document-only mode honestly free of GPU
contact. If you need PDF coverage, run a Full scan.

You can change a template's mode any time. Switching is one click.

Credits & monthly budget (admins)

Your monthly credit allowance is set automatically by your Atlassian
Marketplace user count tier:

User count

Monthly credits

User count

Monthly credits

Up to 10 users

100

11–100

1,000

101–250

3,000

251–1,000

10,000

1,001–2,500

25,000

2,501–5,000

50,000

5,001–7,500

75,000

7,501–10,000

100,000

10,001–15,000

150,000

15,001–25,000

250,000

25,001+

500,000

Evaluation licenses get 100 credits/month so you can fully test
OCR scanning before subscribing.

The Credits pill in the app header shows your monthly usage at a
glance. Click the ↻ refresh icon if your tier looks wrong (the
detection caches for 1 hour); refresh re-checks your active user count
and updates the allowance.

Credits reset automatically at the start of each calendar month.
Unused credits do not roll over.

If you exceed your monthly limit, Document-only scans continue to
work (they use zero credits). Full scans are blocked until next
month or until you upgrade.

Privacy & data handling (summary)

  • All persistent data lives in Atlassian's Forge storage, isolated
    per Jira site. Nothing is stored on Actonic servers.

  • OCR processing happens on dedicated EU-based GPU infrastructure
    managed by Actonic. No public AI services are involved (no OpenAI,
    Google, Anthropic).

  • Attachment binaries are processed in memory and discarded
    immediately after extraction.

  • Only matched text snippets (with short context) are stored ,
    never the full attachment content, never the full extracted text.

  • The app does not read or store reporter, assignee, or any
    user-identity field from your issues. Audit logs reference the
    Atlassian accountId of the admin who triggered actions; no display
    names or emails are stored.

  • See the in-app Privacy Policy, Terms of Service, and How
    It Works panels (footer) for the full text.

Permissions the app requests

Scope

Used for

Scope

Used for

read:jira-work

Read issues and attachment metadata for the JQL scopes you define.

read:jira-user

Reserved for future user-context features; no user data is currently stored.

write:jira-work

Delete attachments when an admin uses the bulk-delete feature.

storage:app

Store templates, scan results, and audit logs in your isolated Atlassian storage.

external fetch: api.runpod.ai

Send attachment binaries to the OCR service for text recognition.

Statistics dashboard

The dashboard (alongside your templates) aggregates stats across all
completed scans:

  • Templates, scans run, issues scanned, files processed, matches
    found, match rate

  • Matches by source (OCR vs direct extraction)

  • Top matched words

  • Top patterns (which template found the most)

  • Most violated projects (clickable to Jira)

  • Most violated work items (clickable to Jira)

Statistics update on every visit and only count completed scans.

Troubleshooting

A scan is stuck on "Waiting for OCR"
The first scan after an idle period takes 30–90 seconds while the
OCR service warms up. Subsequent scans run normally. If a scan
exceeds the per-job time budget, the file is skipped with a warning
and the scan continues.

A scan auto-paused with "repeated errors"
After three consecutive errors on full-scan mode, the app pauses
automatically to avoid burning credits on a broken state. Use Resume
scan once whatever was wrong (network, OCR availability) clears.
Document-only scans never auto-pause.

A specific file shows "Could not read… encrypted, password-protected,
or unsupported format"
The file is one of: password-protected, in a non-standard binary
format (e.g. XLSB instead of XLSX), or corrupted. Open it locally to
verify, then either re-save it in a standard format or remove it from
the issue.

The Credits pill shows the wrong tier
Click the ↻ refresh icon. The tier is detected from your active
Atlassian user count and cached for one hour; refresh forces an
immediate re-check.

An attachment didn't get scanned
Either it isn't a supported file type, it exceeds the per-file size
limit (50 MB PDF / 20 MB image), or the issue wasn't returned by
your JQL. Check the scan result's "skipped" count and the warnings
list for details.

FAQ

Q. Does the app delete attachments automatically?
No. Deletion always requires an explicit click and confirmation by an
admin from the results page.

Q. Can the app scan archived attachments / old issues?
Yes, define a JQL scope that includes them.

Q. Does the app work with Jira Service Management?
Yes. The app is compatible with both Jira Cloud and Jira Service
Management. Service desk attachments (customer-uploaded screenshots,
ID scans, exports) are exactly the kind of attachments most worth
scanning.

Q. Where is data stored?
In Atlassian's Forge storage, isolated to your Jira site. OCR
processing is ephemeral (RAM only) on EU-based GPU servers managed by
Actonic. No data on Actonic servers.

Q. Are credits per-user or per-instance?
Per-instance (per Jira site). All admins on the same site share the
same monthly allowance.