Here’s Why It’s a Silent Security Risk
f you manage a Jira Data Centre instance, you’ve likely encountered system health warnings in the Atlassian Troubleshooting & Support Tools. One critical notification that often gets ignored or deferred is the "Health Check: Local Backup Security"warning. At first glance, having automated backups saved locally inside your Jira directories feels convenient. After all, if something goes wrong, the backup is right there, ready to restore... right?
In reality, storing unencrypted backup files inside your application storage creates a massive security vulnerability.
As an Official Atlassian Solution Partner, we regularly see growing enterprise teams trip over this exact issue during routine maintenance. Let’s break down why this health check fails, what risks it exposes, and how you can resolve it permanently.
What Triggers the "Local Backup Security" Warning?
Jira automatically runs background health checks to ensure server security and stability. This specific check scans your Jira directories—specifically:
If Jira finds any .zip backup files residing in these folders on single-node or clustered Data Center nodes, it immediately flags a warning:
Found
Why Is Storing Backups on the Jira Server Dangerous?
Ignoring this warning leaves your organization exposed to two primary security vector risks:
1. Unencrypted Data Exposure
Local XML export backups contained in .zip files store unencrypted instance data—including project details, internal user comments, personal identifiable information (PII), and intellectual property. If a rogue user or malicious actor gains access to the underlying web server filesystem, they can exfiltrate your entire Jira database in a single download.
2. Ransomware & Cyber Attack Vulnerability
If an attacker compromises your application server, local backups are sitting ducks. Attackers can delete or encrypt these backup files alongside your live data. When disaster strikes, you lose both your live production instance and your recovery point—leaving you with zero fallback options.
4 Ways to Resolve the Local Backup Security Warning
Atlassian recommends replacing local filesystem backups with enterprise-grade backup strategies. Here are four steps you can take:
1. Immediately Relocate Existing Backups
Move all existing .zip files out of
2. Review and Adjust Scheduled XML Backups
If Jira's built-in Scheduled Backupfeature is enabled, it will continuously generate new local .zip files and trigger the health check warning repeatedly.
3. Implement Database-Native Backup Policies (Recommended)
For production environments, best practices dictate using database-native backup tools (e.g., PostgreSQL, Oracle, or MySQL native utilities) combined with regular snapshotting of shared and local home directories. This provides faster recovery point objectives (RPO) and recovery time objectives (RTO) without leaving exposed XML dumps on the web application tier.
4. Offload XML Backups to Amazon S3 (Jira 9.16+)
If you are running Jira 9.16 or newer, Jira natively supports storing XML backups directly in Amazon S3 buckets. This ensures backups bypass local application disks altogether while taking advantage of AWS encryption and access policies.
Key Takeaways for Jira Admins
| Issue | Risk Level | Best Action |
|---|---|---|
| Local .zip files in Jira directories | High | Move files to secure off-server storage immediately. |
| Active XML scheduled backups | Medium | Transition to database-native backups or automated offloading. |
| Unmonitored Jira System Health | High | Conduct periodic health checks to catch security risks early. |
How Healthy Is Your Jira Instance? Find Out for Free.
Fixing local backup security is just one piece of keeping Jira fast, compliant, and secure. Over time, Jira environments accumulate orphan schemes, unindexed custom fields, permission leaks, and performance bottlenecks that slow down your teams and increase security risks. As an Official Atlassian Solution Partner in India, we help engineering and IT leaders optimize, secure, and scale their Atlassian footprint.
Get a Free Jira Health Check!
We are currently offering Free Comprehensive Jira Health Checks for businesses in India. Our certified Atlassian experts will run a full audit of your environment, covering: