Sample Idea Decision Brief · complete, not blurred

StatusLens

Change-control evidence for audited Jira teams (SOC 2, ISO 27001, SOX): approvals, exceptions and an exportable evidence pack, built as a Forge app

Reviewed 30 Sept 2026 · built from the public assessment

01 / 10

The decision

As described:StopNarrowed:Narrow

No as a general Jira reporting suite. Go, small, as an audit-evidence app.

The single most important thing

Get 3–5 audited Jira teams to pay for a hand-made change-control evidence pack before you build the app.

Segment: Jira Cloud sites of 30–500 users at companies with a SOC 2, ISO 27001 or SOX audit in the next 6 months.
Job: "Show my auditor that every sampled production change was approved by someone other than the person who did it, and tell me about the exceptions before they do."
How: a concierge pack. The customer's admin runs your JQL and exports the history (or you both do it on a call). You build the pack in a spreadsheet template: approvals, self-approvals, skipped steps, time in approval, a seeded sample. Charge $200–500 per pack. Automate only what you've done by hand at least 5 times.

The plan works at ~15 hrs/week. Full-time, compress weeks 5–10 by about a third and use the time for content.

Week-by-week

Weeks	Goal	Exit criteria
1–2	Discovery. 12–15 calls with Jira admins and engineering or compliance leads at audited companies. Ask for their last auditor request list, how long the Jira evidence took, and what they use today (screenshots, JQL, SaaSJet, Vanta or Drata). Check what Vanta and Drata already pull from Jira. Check the name (trademark, domain, Marketplace).	You can write the top 3 evidence requests in the buyers' words, with the hours each one took. You know whether compliance platforms already cover it.
3–4	Concierge packs. Offer 5–8 of them a paid evidence pack for their current or last audit period. Create the Forge developer account and a "hello changelog" app in parallel.	3+ paid packs. If fewer than 2 will pay, the pain isn't real at this price. Change the segment (JSM SLA evidence) or the job, not the pitch.
5–8	Build the thin v1 on Forge (Forge UI, no Connect, no egress). Event capture into Forge SQL, a slow resumable backfill, a required-path setting per project, the exceptions report, a seeded sample, and XLSX and PDF export with a hash. Private installs for design partners.	Design partners generate a pack themselves in under 15 minutes. Backfill of a 20k-issue project finishes without `429` errors.
9–10	List it. Marketplace listing: audit-first copy, screenshots of the exceptions report, docs, privacy statement, pricing tiers. Submit for approval (allow 1–3 weeks; approval time not verified). Publish 3 guides: "SOC 2 change management evidence from Jira", "Segregation of duties in Jira", "How auditors sample Jira changes".	Listing approved, with the "Runs on Atlassian" badge. Design partners moved to paid Marketplace subscriptions.
11–12	Measure and decide.	Listed, 3–5 paying sites, 20–30 trials, first exception shown within 24 hours for ≥70% of trials. Hit it: keep going with the monthly control check. Miss it: go back to discovery.

Kill criteria (write these down now)

If at day 90 you have fewer than 2 paying sites and fewer than 10 trials, or design partners don't use the pack in their actual audit, the wedge is wrong. Don't respond by adding reports. Respond by changing the buyer or the job, once. If it misses again, stop.

02 / 10

Who has the problem, and what they use today

"Jira admins and PMOs" is two buyers with two different jobs. Split them by what they're trying to do and whether they have a budget and a deadline:

Segment	What they want	Willingness to pay	Pain score (1–10)	Verdict
Team leads and agile coaches wanting cycle time and bottlenecks	"Where does work get stuck?"	Low to moderate. Many use the free app or native reports.	5. Useful, easily deferred.	Avoid as the lead segment. It's the most crowded search on the Marketplace.
PMOs wanting cross-project roll-ups and portfolio progress	Roll-up estimates, progress across projects, exec dashboards	Moderate to high, but they already use JXL, Structure, Jira Plans or a BI tool	6. Real, but served.	Avoid. Different job, longer sale, strong incumbents.
Service desk managers wanting SLA reports	Time to first response, breaches, business hours	Moderate. JSM has native SLAs, and Appfire's Time to SLA has 3.4k installs.	6	Second segment later (approval-time and SLA evidence for audited service desks).
Jira admins and engineering or compliance leads at audited companies (SOC 2, ISO 27001, SOX, regulated industries)	"Prove to the auditor that every production change was approved, and by whom"	High when the audit is near. A failed control or a week of screenshots costs more than a year of the app.	8 near the audit, 5 between audits	Best buyer. Deadline, budget, a clear job. The risk is seasonality.
Regulated-industry quality teams (medical devices, pharma: FDA 21 CFR Part 11)	Full audit trail, record integrity	High, but the bar is high (validation, vendor audits)	8	Real, but it's a heavier sale with validation paperwork. Later, if at all.

Assumption: the idea as described serves all five. The feature that earns a price with a deadline (audit evidence) is the one buried last in the list. Pull it to the front.

Overall pain score for the product as described: 5/10. For the recommended audit-evidence version: 7/10, peaking at 8 around audits.

Competitors and alternatives

Time in status and cycle time (the most crowded)

App	Vendor	Installs	Rating (reviews)	Notes
Status Time Reports Free	Bloompeak	~10.5k	4.7	Free. Leads by installs. There's also a paid version with ~1.3k installs. (Read from a Marketplace search page. Medium confidence.)
Time in Status	SaaSJet (Platinum Partner)	5,322	4.5 (207)	Cloud Fortified, Runs on Atlassian. Standard and Advanced editions. Claims 5,000+ companies. Rovo agents. Updated 25 Sept 2026.
Timepiece – Time in Status	OBSS (Gold Partner)	4,442	4.8 (270)	Cloud Fortified. Cloud, Server and DC. 15+ report types, AI assistant, scheduled reports, up to 1M issues per report. Updated 24 Sept 2026.
JXL – Sheets	Appfire	~4.7k	5.0	Spreadsheet view with history columns, sum-ups and time in status. (Search page. Medium.)
Time in Status Reports	votazz	1,461	4.5 (36)	Cloud Fortified. Power BI feed, median and 85th percentile.
Time in Status Report, Cycle & Lead Time	Broken Build (Gold)	919	5.0 (10)	Cloud Fortified, SOC 2 Type 2. Adds "operational SLA" in Advanced.
Issue Time in Status	GTOLA	863	5.0 (6)	Free, unsupported, last updated Feb 2024.
Others	Agilis LT, TypeSwitch, Colined, JiBrok, Tempo (Custom Charts) and more	200–900 each	—	Tempo publishes a post arguing "there's almost a dozen" such apps and none are worth buying.

Reading: 12+ apps, a free leader, two paid leaders with 200+ reviews each, and weekly release cadences (both leaders shipped a release in the last week of Sept 2026). A new generic entrant would be invisible.

SLA reporting

Time to SLA (Appfire): ~3.4k installs, 4.8. (Search page. Medium.)
JSM has native SLAs. Broken Build, SaaSJet and JiBrok sell SLA add-ons.

Cross-project roll-ups and portfolio reporting

JXL (Appfire), Structure (Tempo), Pivot Report (Colined, ~910 installs), Dashboard Hub Pro (Appfire, ~3.1k).
eazyBI for full BI. Verified pricing from 1 Dec 2025: $3.00/user/month for 1–100 users, $0.60 for 101–250, $0.25 for 251–1,000, $0.20 above 1,000.
Jira Plans (formerly Advanced Roadmaps) natively on Premium and Enterprise. (Not re-verified in this run.)

Audit and issue history

App	Vendor	Installs	Notes
Issue History for Jira (Work Item History)	SaaSJet	3,060	4.7 (95). Runs on Atlassian, Cloud Fortified, SOC 2. Exports XLSX, CSV and PDF or via API. Deleted-issue tracking and restore, sensitive-data scan. Markets HIPAA and FDA 21 CFR Part 11 compliance.
Issue History & Snapshots Reporter	CIFJ	not captured	Point-in-time snapshots, bulk CSV and Excel export, "audit and compliance" positioning.
Issue History Reports for Jira	not captured	not captured	Audit trail for compliance.

Reading: "who changed what and when" is already sold, including with compliance language. What wasn't found in this run is an app that turns history into control evidence: approval by someone other than the implementer, skipped required steps, sampled changes per audit period, and an exceptions list. That's the gap. It's narrow, and an incumbent could close it quickly.

Native Jira

Jira Cloud has an Average Time in Status gadget, but it only covers issues resolved in the last 30 days (secondary source, medium confidence). The Control Chart excludes non-working days but not non-working hours (OBSS, Feb 2026).
Jira has no native change-control evidence report that was found in this run. Atlassian's org-level audit log covers admin events, not per-issue approval evidence. (Not verified in this run.)
Risk: Atlassian's Rovo AI and Atlassian Analytics could answer more reporting questions natively over time. No specific announcement was verified.

Compliance automation platforms

Vanta, Drata and similar tools connect to Jira for tasks and some evidence. Their Jira change-management evidence depth was not verified in this run. If they already produce approval exceptions from Jira, the wedge narrows further. Check this in the first two weeks (see plans/08).

03 / 10

Evidence ledger

27 cited sources · evidence maturity Moderate. Findings below link to the full research; a confidence label appears only where the research states one.

R1.1 Forge revenue shareSourced
R1.2 Stair-step approachSourced
R1.3 Agile DocsSourced
R1.4 No verified recent solo Forge revenue caseSourced
R2.1 Time in statusSourced
R2.2 Marketplace search for "time in status"Inferred
R2.3 Vendor comparison postsInferred
R2.4 Audit and historySourced
R2.5 PricingNot rated

04 / 10

Economics, with the math visible

At the plan's $80/month and 2% monthly churn, adding 4.6 customers a month (the pace that hits the month-24 checkpoint), growth levels off at 230 customers ≈ $18k MRR (new ÷ churn).

MRR	Customers (target ÷ price)	Months at plan pace	Odds · ~15 hrs/wk	Odds · full-time
$1k	13	3 mo	≈ 55 in 100	≈ 70 in 100
$3k	38	9 mo	≈ 38 in 100	≈ 52 in 100
$5k	63	16 mo	≈ 28 in 100	≈ 42 in 100
$10k	125	3 yr 3 mo	≈ 15 in 100	≈ 26 in 100
$20k	250	not reached	≈ 7 in 100	≈ 14 in 100
$50k	625	not reached	≈ 2 in 100	≈ 4 in 100

Odds are judgment estimates with the founder conditions met. Change the numbers in the what-if model →

05 / 10

Founder-fit requirements

1. You can ship and support a Forge app yourselfodds × 0.65 if missing
TypeScript, React (Custom UI or UI Kit), Jira REST APIs and Forge storage. If you have to hire the build, the odds drop and the timeline slips by a quarter.
2. Direct access to 15 buyers before buildingodds × 0.65 if missing
Jira admins, engineering managers or compliance leads at companies that go through SOC 2, ISO 27001 or SOX audits. You need to talk to them in the first 3 weeks. Ideally you've prepared Jira evidence for an audit yourself.
3. A steady cadence for 24 monthsodds × 0.65 if missing
a fixed number of hours per week available, with support replies within one business day and a release at least monthly. Marketplace reviews and response times decide ranking, and a quiet app sinks.

06 / 10

As described, and narrowed

As described

Stop

$10k MRR odds: ≈ 6 in 100

Narrowed

Narrow

$10k MRR odds, full-time: ≈ 26 in 100

Vitamin or painkiller?

A vitamin as described, with one painkiller inside.

Vitamins: time in status for team leads, roll-ups for PMOs, dashboards. Useful, and deferred whenever budget is tight. Free options exist.
Painkiller: "Our SOC 2 auditor wants evidence that 25 sampled production changes were each approved by someone other than the engineer, and we have until Friday." Today this is screenshots, JQL and spreadsheets, days of an engineer's time, plus the risk of an exception finding.
Test: if the app disappeared tomorrow, what would the customer lose? For a time-in-status report: a chart they can approximate with the free app. For audit evidence: days of work before the next audit, and the monthly early warning on control failures.

07 / 10

Risks and pre-mortem

01Nobody found it~45% of failure cases
02Audit buyers left after the audit~30%
03The platform changed the rules~25%

Read the full pre-mortem →

08 / 10

Thirty-day validation path

Weeks	Goal	Exit criteria
1–2	Discovery. 12–15 calls with Jira admins and engineering or compliance leads at audited companies. Ask for their last auditor request list, how long the Jira evidence took, and what they use today (screenshots, JQL, SaaSJet, Vanta or Drata). Check what Vanta and Drata already pull from Jira. Check the name (trademark, domain, Marketplace).	You can write the top 3 evidence requests in the buyers' words, with the hours each one took. You know whether compliance platforms already cover it.
3–4	Concierge packs. Offer 5–8 of them a paid evidence pack for their current or last audit period. Create the Forge developer account and a "hello changelog" app in parallel.	3+ paid packs. If fewer than 2 will pay, the pain isn't real at this price. Change the segment (JSM SLA evidence) or the job, not the pitch.
5–8	Build the thin v1 on Forge (Forge UI, no Connect, no egress). Event capture into Forge SQL, a slow resumable backfill, a required-path setting per project, the exceptions report, a seeded sample, and XLSX and PDF export with a hash. Private installs for design partners.	Design partners generate a pack themselves in under 15 minutes. Backfill of a 20k-issue project finishes without `429` errors.
9–10	List it. Marketplace listing: audit-first copy, screenshots of the exceptions report, docs, privacy statement, pricing tiers. Submit for approval (allow 1–3 weeks; approval time not verified). Publish 3 guides: "SOC 2 change management evidence from Jira", "Segregation of duties in Jira", "How auditors sample Jira changes".	Listing approved, with the "Runs on Atlassian" badge. Design partners moved to paid Marketplace subscriptions.
11–12	Measure and decide.	Listed, 3–5 paying sites, 20–30 trials, first exception shown within 24 hours for ≥70% of trials. Hit it: keep going with the monthly control check. Miss it: go back to discovery.

09 / 10

Continue, narrow, pivot, and stop gates

Day 30
On track (~15 hrs/week)12 buyer calls, 3 paid evidence packs
If you miss itSwitch the wedge once, to JSM SLA evidence for service teams. Missing twice means stop.
Day 90
On track (~15 hrs/week)App listed, 3 paying sites, 20 trials
If you miss itCut to the single most-used report (usually self-approval exceptions).
Month 6
On track (~15 hrs/week)$1k MRR, ≥25% trial-to-paid
If you miss itPivot A: approval-time and SLA reports for audited service desks. Pivot B: sell the evidence pack as a one-off per audit plus a subscription.
Month 12
On track (~15 hrs/week)$2.5k MRR, ≤3% monthly logo churn, 10+ reviews
If you miss itStop adding features. Fix onboarding, the listing and churn. A profitable $2–4k app is a valid outcome.
Month 18
On track (~15 hrs/week)$4.5k MRR
If you miss itPut everything into the best source of trials. Decide whether to build a second app on the same data.
Month 24
On track (~15 hrs/week)$7k MRR
If you miss itAbove target with churn ≤3%: aim for the $20k rung in year 3. $1–7k: run it as a profitable app. Below $1k: stop, or sell the app to a Marketplace vendor.

Kill criteria

10 / 10

Sources, assumptions, and unknowns

Unknowns that would change the verdict most

Hours per week available — and for how many months.
Have you shipped a Forge or Connect app before? — Any existing Marketplace vendor account?
Have you prepared audit evidence — (SOC 2, ISO 27001, SOX) from Jira yourself, or do you know people who have?
Who can you reach this month — how many Jira admins or compliance leads at audited companies?
Whether Vanta, Drata or similar platforms already produce change-control exceptions from Jira — for their customers. If they do, the wedge narrows.
Name check — is "StatusLens" free as a trademark, domain and Marketplace listing name?
Your goal for the app — a profitable small business you keep, or an asset to sell in 2–3 years. It changes how much you invest in reviews, security certifications and documentation.

Assumptions made

Input	Assumption used	If actually different…
Target customer	"Jira admins and PMOs" as described. The recommended version narrows it to admins and engineering or compliance leads at audited companies.	If you already know audited Jira teams, or have run audit evidence yourself, the recommended odds hold or rise. If your network is PMOs, the roll-up version is the natural fit, and its odds are lower (see 01).
Pricing	None stated. Recommended: $1.50 / $0.75 / $0.30 / $0.15 per user per month by tier, ~$80 blended per paying site	Much lower pricing (e.g. $0.50/user for the first 100) roughly doubles the sites needed at every rung, and pushes each rung's odds down by about a third.
Hours per week available	Two cases: ~15 hrs/week and full-time	Under ~10 hrs/week, a Forge app with support and a monthly release is hard to sustain. Treat the 15 hrs/week column as an upper bound.
Technical skill	You can build and support a Forge app yourself (TypeScript, React, Jira REST APIs)	If the build is outsourced, add a quarter to the timeline and multiply the odds by ~0.65. Every rate-limit or platform change then costs a contractor invoice.
Geography	Irrelevant to selling. The Marketplace sells globally in USD.	Your location matters only for tax, company set-up and support hours. Buyers are mostly US and European. Not verified.
Stage	Idea. No code, no users, no revenue.	Any existing Forge app or Marketplace listing, even an unrelated one, shortens the timeline and helps ranking (vendor history and reviews).
Team	One person	A second person with audit or GRC experience is the biggest positive change.
Traction	None	3 paid evidence packs change this from "idea" to "evidence".
Funding	None, none needed	Doesn't change the advice.
Competitor figures	Install counts and ratings from Marketplace pages on 30 Sept 2026. Prices unverified except eazyBI.	Re-check prices, trial lengths and editions of SaaSJet, OBSS, Bloompeak, votazz and Broken Build before setting yours.
Churn	2–4% monthly logo churn for paying sites	Not verified. If post-audit churn is higher than 4%, the $10k+ rungs fall by about half.
Trial-to-paid	~25–30%	Not verified. Measure it from month 4.

27 cited sources