Detecting phone numbers in Jira attachments
Phone numbers are easy to overlook and easy to leak. They sit in customer spreadsheets, email signatures captured in screenshots, scanned forms, invoices, and contact lists that get attached to tickets and then forgotten. A phone number is personal data, and in bulk it’s a contact database you’re now responsible for protecting. The upside, compared with names or addresses, is that phone numbers have enough structure to detect well — if you account for how messily people actually write them. If you want to find phone numbers in Jira attachments, a few well-tuned patterns will get you a long way.
Where phone numbers accumulate
The sources are familiar once you look. A sales team attaches a lead list with phone columns. A support agent screenshots a customer’s profile that includes a mobile number. A scanned application form carries a contact number. An invoice or letterhead includes a landline. None of it is careless — it’s the normal exhaust of doing business in a ticketing tool — but it adds up to a meaningful volume of contact data living somewhere it was never meant to be governed.
Why your existing tools miss them
As with every data type in attachments, Jira’s search indexes fields and comments, not file contents — so a number inside a spreadsheet, PDF, or image never surfaces in a query. A malware scan treats a contact list as a clean file and moves on; the data inside is the risk, not the file. And numbers inside screenshots or scanned forms are invisible to text-based scanning until something reads the image. That something is OCR.
Patterns that handle real-world formatting
Phone numbers are a good fit for regex, with one caveat: people write them inconsistently. The same number might appear as +49 611 1234567, 0611 1234567, (0611) 123-4567, or one unbroken string. A robust approach uses a pattern that tolerates spaces, dashes, parentheses, and an optional country code — for example, an international form like \+?\d[\d\s().-]{7,}\d as a starting point, then tightened for the regions you operate in (a dedicated pattern for German, UK, or US formats reduces noise). Attachment Scanner for Jira lets you supply these patterns directly — simple text or regex — so you decide how broad or strict the match is. You can also anchor on labels like Tel:, Phone, or Mobile to cut false positives from order numbers and IDs that merely look numeric.
Running and scoping the scan
Point the scan at the projects most likely to hold contact data — sales, support, recruitment — using JQL, and the app reads every supported file: Office documents and CSVs, text-layer and scanned PDFs, plain text, and images, with OCR where needed. Document-only scans cover the exported lists and text files for free; full scans add the screenshots and scanned forms. Scoping with JQL keeps the result set reviewable and the OCR credit use predictable, rather than scanning years of unrelated tickets at once.
Triage and remediation
A loose number pattern will inevitably match things that aren’t phone numbers — order references, ticket IDs, timestamps. That’s why every match arrives with context: the issue key, file name, extraction type, matched text, and the surrounding content, so you can confirm a real phone number in seconds. The statistics view shows where matches concentrate across projects and work items, helping you focus on the lists and queues carrying the most contact data. When a file holds numbers it shouldn’t, bulk-select and delete those attachments — an explicit, admin-confirmed action recorded in the audit log, with no automatic deletion.
Privacy, limits, and a starting point
The privacy model is the same one that makes the app suitable for regulated data: OCR on dedicated EU/EEA GPU hardware, no public AI service, attachments processed in memory and discarded, and only matched snippets stored in Atlassian’s Forge storage, isolated per site. Be realistic about regex: it’s a strong detection aid for phone numbers but not infallible, so treat results as a prioritised worklist. And remember the app is on-demand and Jira Cloud only for now. With patterns tuned to your regions, phone-number detection is one of the more accurate PII scans you can run — and it covers the screenshots and exports your other tools never open. You can try Attachment Scanner for Jira free for 30 days from the Atlassian Marketplace.
Request