7. What's Missing: The Gap Between Built and Paid, Renewed, Referred
Assumption: nothing is built yet. So these are gaps between the idea and a business.
7.1 Gaps to pay
| Gap | Why it blocks payment | Fix |
|---|---|---|
| Two buyers, no single job | A listing for "admins and PMOs" converts neither | One buyer: the Jira admin or engineering or compliance lead at an audited company. One job: change-control evidence. |
| No pricing | Undefined. On the Marketplace, price is per user of the whole Jira site, so it has to be set with site size in mind. | Suggested (verify in the first 90 days): $1.50/user/month for 1–100 users, $0.75 for 101–250, $0.30 for 251–1,000, $0.15 above. Annual at 10× monthly (the Marketplace rule). Blended ~$80 per paying site. Competitor per-user prices were not verified. eazyBI, a full BI tool, is $3.00 for its first 100 users. |
| No quantified value promise | "Better reporting" doesn't justify a line item | "Your auditor's change sample, with approvals and exceptions, in 10 minutes instead of 2 days." Measure it with design partners. |
| Commodity core | Time in status is free elsewhere | Lead with evidence and exceptions. Time in status is a supporting table. |
| Trust at install | Audit buyers ask where their data goes | "Runs on Atlassian" badge, a one-page data statement, and data residency that matches the site. Security self-assessment and SOC 2 later. |
| The Marketplace trial window | Trials are time-boxed (eazyBI's is 30 days). Audit buyers may install months before they need it. | An onboarding flow that shows the first exception within 10 minutes of install, even before the backfill finishes. |
7.2 Gaps to renew
| Gap | Fix |
|---|---|
| Once-a-year job | A monthly control check inside Jira, or on a Confluence page. It catches self-approvals while they're easy to fix. |
| Monthly billing | Push annual billing. It's cheaper per month, and it covers the gap between audits. |
| Nothing accumulates | Store the evidence history. Leaving means losing your record of past periods, exceptions and resolutions. |
| Silent data gaps | Show backfill status and data completeness in every pack. A surprise gap ends trust. |
| Platform breakage | Monitor rate-limit headers and job failures. Alert the admin before they notice. |
7.3 Gaps to refer
| Gap | Fix |
|---|---|
| Nothing visibly shareable | The evidence pack is handed to the auditor by design. A small "Generated with StatusLens" footer puts the name in front of audit firms, who see dozens of clients. |
| No review habit | Ask for a Marketplace review at day 30 of paid use, after the first clean monthly check. |
| No content engine | One guide per audit search term, plus Atlassian Community articles. Incumbents already publish comparison posts there. |
| No partner channel | Audit readiness consultants and small audit firms recommend tools. Offer them a free partner licence (via Marketplace concessions, if available) and a co-branded checklist. |
7.4 Non-product gaps
Distribution
- Marketplace search is the main channel and it's rented. Leaders own "time in status".
- Channels that work for Jira apps: audit-specific search terms, Atlassian Community articles, comparison pages, and consultant or partner referrals.
- Channels that burn money or time: paid ads to "Jira admins", conference booths, cold outbound at ~15 hrs/week.
Positioning
- Current: "reports and audit exports for Jira admins and PMOs". Generic.
- Better: "Change-control evidence from Jira for your SOC 2 or ISO 27001 audit: approvals, exceptions, and the pack your auditor asks for."
- One sentence, one buyer, one outcome. Consider a name that says "evidence" or "audit" rather than "status".
Sales motion
- Product-led through the Marketplace, with founder-led onboarding calls for the first 20 sites.
- No sales team. Larger sites may ask for security questionnaires, so prepare one standard answer set.
Forge platform limits (verified 30 Sept 2026)
| Limit | Figure | Design response |
|---|---|---|
| Jira REST rate limit | 65,000 points/hour shared across all installs (Tier 1). Tier 2 per-tenant pools of 100,000–150,000 base points plus 10–30 per user, capped at 500,000, after Atlassian review. Burst limits of ~100 GET requests per second per tenant. | Event capture, slow resumable backfill, caching, and an early Tier 2 request. |
| Function timeouts | 25 s user-led, 55 s web triggers, 900 s async and scheduled | Async jobs for packs and backfills. |
| Invocation rate | 1,200/min per user, 7,000/min and 300/s per install | Batch front-end calls. |
| Storage | 1 GiB per production install (medium confidence). KVS values ≤240 KiB. | Store derived facts only. Use Forge SQL for queries. |
| Platform billing | Since 1 Jan 2026. Free allowances (200,000 GB-seconds of functions, 1 GB logs, 1 hour of SQL compute a month, and so on). Forge LLM usage has no free allowance. | Track cost per site. Avoid LLM features in v1. |
Compliance and legal
| Area | Requirement |
|---|---|
| Marketplace terms | Partner agreement, listing approval, privacy policy, support and security requirements. Exact current requirements not verified in this run. |
| Data privacy | Jira issue data includes personal data (names, emails, comments). GDPR (EU/UK) and CCPA/CPRA. Staying inside Atlassian storage with matching data residency keeps this simple. |
| Claims | "Evidence" and "exceptions", never "SOC 2 compliant", "audit-proof" or "Part 11 validated". The auditor decides. |
| Refunds | Atlassian gives customers full refunds within 30 days of purchase. Discretionary between 31 and 60 days. Expect some post-audit refund requests. |
| Payouts | Paid within 30 days after the end of a month in which you've accrued $500+. |
Team
Not provided. You need, at minimum: one developer comfortable with Forge, TypeScript, React and the Jira REST APIs, and someone who has prepared audit evidence (an ex-IT auditor, a GRC analyst, or an engineering manager who ran SOC 2). One person can be both. Without the audit background, you'll build reports instead of evidence.
Metrics and instrumentation
Minimum set:
- activation: first exception shown within 24 hours of install;
- trials per month, by source;
- trial-to-paid rate;
- paying sites and MRR;
- month-3 retention, and retention after each customer's audit;
- monthly control-check open rate;
- support tickets per 10 paying sites;
- rate-limit points used per site per hour.
Forge analytics egress is allowed under "Runs on Atlassian" only if it contains no in-scope end-user data, so keep product analytics anonymous.