Signing records a SHA-256 fingerprint of the exported file, who exported it, when, and what it was for. Anyone with the admin page can later drop the file back in and see whether it has changed by even one byte.
Signing an export
- Run a report on the Changes tab.
- Beside the export buttons, tick Sign it.
- A box appears asking What is it for? Type the reason, for example
Q3 SOX evidence for control CC7.2. Up to 500 characters are kept. Left empty, the reason is recorded as Export for audit evidence. - Press Export CSV, Export Excel or Export PDF as usual.
You get two downloads:
| File | What it is |
|---|---|
| The export itself | Exactly the file you would have got without signing |
<name>.export-record.txt |
A plain-text record of the signature, to keep alongside the export |
The note beside the buttons changes to show the row count, the word signed, and the first characters of the SHA-256.
The fingerprint is computed in your browser from the exact bytes you downloaded. Only the fingerprint and the details below are sent to the app’s storage on your site. The file itself is never uploaded.
What is recorded
| Detail | Example |
|---|---|
| SHA-256 | The 64-character fingerprint of the file |
| File name, size and row count | undotrail-2026-09-25.csv, 1,204,331 bytes, 12,481 rows |
| Exported at | The time in UTC |
| Exported by | Your display name and Atlassian account ID |
| Meaning | The reason you typed |
| JQL and query | The report that produced the file, so it can be run again |
| Report | The report in words, with every filter that narrowed the rows (for example Fields: Status · Any field: In Progress -> Done), since the JQL alone only says which work items were read |
The same details are printed in the .export-record.txt file, together with instructions for checking the file.
If identical bytes are signed twice, the first record is kept. A later signature never rewrites an earlier one.
Verifying a file
- Open Settings → Marketplace apps → UndoTrail and scroll to Verify a signed export.
- Choose the file under Exported file.
- The app computes the file’s SHA-256 in your browser and looks it up. The file stays on your machine.
| Result | Meaning |
|---|---|
| Unaltered. | The file is byte-for-byte the one that was signed. The result names who exported it, when, the reason they gave and the row count |
| No record for this file. | Either it was never signed, or its contents have changed since it was exported |
Both results show the SHA-256 that was checked, so it can be compared with the one in the .export-record.txt file.
Where it is available
Signing is offered on the Changes tab of the explorer, on Apps → UndoTrail and on a project’s UndoTrail page. It covers CSV, Excel and PDF. It is not offered on a single work item’s history, the Reports tab, the Deleted items tab or the Security scanner tab.
You need to be able to export to sign, so the Export permission on the admin page applies. See Admin settings.
Limitations
- This is a tamper-evidence record, not an electronic signature under FDA 21 CFR Part 11. It proves a file has not changed since it was exported, and records who exported it and why. It does not replace a signature workflow your regulator may require.
- Any change to the file breaks the match, including opening it in a spreadsheet and saving it again. Keep the original download untouched and work on a copy.
- Verification is on the admin page, so it is done by someone who can open that page.
- Signature records live in the app’s storage on your site until the app is uninstalled. Uninstalling ends the app’s access to them, and Atlassian deletes that storage 28 days later. The SHA-256 in the
.export-record.txtfile can still be checked with any standard SHA-256 tool. - There is no screen that lists every signed export. A record is found by checking the file.