eucsoft

Atlassian

Work management · atlassian.com · last read 2026-11-09

Products Atlassian names as its own: Jira, Confluence, Trello and 18 more

At a glance

Is Atlassian GDPR compliant?
No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what Atlassian itself publishes, each answer linked to its source and the date we read it.
Does Atlassian have a data processing agreement (DPA)?
Yes. Atlassian publishes a data processing agreement at atlassian.com. It gives 30 days' notice before a new subprocessor is added. It commits to telling you of a personal data breach within 72 hours. Source and date
Which version of the Atlassian DPA is current?
On 2026-11-09, Atlassian's DPA at atlassian.com printed “Effective starting: August 17, 2026”. Source and date
Does Atlassian have a SOC 2 report?
Atlassian says a SOC 2 Type 2 report is available on request. In Atlassian's words: “For now the SOC 2 report and Bridge Letter available under the Compliance Reports folder are the most current, and valid through the end of the year.” We read this on 2026-10-19. Source and date
Is Atlassian ISO 27001 certified?
Atlassian states ISO/IEC 27001 certification, and says the certificate or audit report is available on request. We read this on 2026-10-19. Source and date
Where is Atlassian's trust center?
Atlassian publishes a page it calls “Trust Center” at customertrust.atlassian.com. Some of its documents sit behind a request or sign-in: the page says “Get Access”. The page mentions SOC 2, ISO 27001, a penetration test, subprocessors and a DPA. We read it on 2026-11-03. Source and date
Does Atlassian use your data to train AI models?
For business plans (Rovo): Third-party LLM providers do not use inputs and outputs to train or improve their services; Atlassian may use de-identified, aggregated metadata to fine-tune Atlassian-hosted open-source models, subject to data contribution settings. For business plans (Rovo and Atlassian Intelligence): customer data not shared with third-party AI providers for training; Atlassian may use de-identified, aggregated metadata to fine-tune open-source models in its own infrastructure, subject to data contribution settings. Source and date
Does Atlassian offer zero data retention?
For business plans (Rovo): Third-party hosted LLM partners operate under zero data retention agreements. Source and date
How does Atlassian transfer personal data out of the EU?
Atlassian's agreement relies on the EU standard contractual clauses, the EU-U.S. Data Privacy Framework and the UK transfer addendum. Atlassian, Inc. is on the official Data Privacy Framework List (status: Active). Source and date
Does Atlassian offer EU data residency?
An EU location exists but requires a paid plan or add-on. Plan it needs: Standard, Premium or Enterprise. Source and date
Who are Atlassian's subprocessors?
Atlassian lists 34 third-party subprocessors; 32 of them name at least one processing country outside the EEA. We last read the list on 2026-10-05. Source and date
How do you report a security vulnerability to Atlassian?
Atlassian publishes a security.txt at www.atlassian.com naming https://www.atlassian.com/trust/security/report-a-vulnerability or [email protected]. Source and date

The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.

Identity

Legal entityAtlassian Pty Ltd
HQAU
Parent company—
Ultimate ownership—
EU contracting entity—
LEI5493005ANNO41NYIM267
US CLOUD Act reachNot determined from the sources read
Sourceatlassian.com · 2026-10-08

Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.

Atlassian data residency

RegionEU data locationMinimum planSourceObserved
EUPaid upgradeStandard, Premium or Enterprisesupport.atlassian.com2026-09-18

EU: CORRECTION of our 2026-09-17 reading, which recorded Enterprise only. Page lists Jira, Jira Service Management, Jira Product Discovery, Loom and Confluence on Enterprise, Premium AND Standard plans. Europe consists of Frankfurt and Dublin; a Germany-only region (Frankfurt) is also offered. Atlassian Government Cloud is US-resident and not eligible.

The same question for every vendor: where SaaS vendors store EU data.

Atlassian's subprocessor list names AWS, Microsoft and Google for hosting or infrastructure. Which SaaS vendors run on which cloud, and the sovereign offerings of each: sovereign clouds.

Subprocessor chain

34 third parties · 15 of the vendor's own group companies · 32 with a country outside the EEA · all read 2026-10-05

SubprocessorCountryPurpose
Amazon Web Services, Inc.USCloud hosting provider (DX)
Amazon Web Services, Inc.SE, IE, DE, CH, GB, CA, AU, SG, KR, US, IN, JPCloud hosting provider; Provision of Atlassian support
Amazon Web Services, Inc. (AWS Bedrock)US, DE, SE, IT, ES, IE, FR, ZA, JP, KR, IN, SG, AU, ID, CA, CH, GB, BH, MX, BRGenerative AI services provider for intelligence product features
Cantab Research Ltd (trading as Speechmatics)USTranscription services
Cloudflare, Ltd.—Content delivery network provider; Hosting provider for the Remote Model Context Protocol (MCP) Server
Clumio, Inc.EU, GB, AU, US, SGBackup solutions provider for Amazon Simple Storage Service (S3)
CrowdstrikeUS—
Databricks, Inc.USInfrastructure provider to enable End User Personal Data querying and analytics features for Forge Apps.
Databricks, Inc.USInfrastructure provider to enable customer data querying, and analytics product features.
e-Core Soluções em Tecnologia da Informaçiupão Ltda.BR, MXCustomer service, support, and cloud migration service provider
Google LLCUSFile Storage
Google Vertex AIUS, BE, NL, FI, SG, TWGenerative AI services provider for intelligence product features; provision of Atlassian support; maintenance of service, safety, and security
Google, LLCUS—
MailchimpUSCommunications technology provider for product notifications and video sharing over email
Mailgun Technologies, Inc.US, EUCommunications technology provider for product notifications
MessageBird USA, Inc, (d/b/a Bird)US, EUCommunications technology provider for product notifications
Microsoft CorporationUS, AU, NLCloud hosting provider
MongoDB, Inc.USCloud hosting provider for JSM Chat (formerly Halp)
NetApp, Inc.USCloud hosting provider
Okta, Inc.US—
OneSignalUSCommunications technology provider for mobile product notifications and video sharing
OpenAI, L.L.C.USGenerative AI services provider for intelligence product features; for the provision of Atlassian support
Partner HeroPH, RO, ZACustomer service and technical support
Plivo, Inc.USCommunications technology provider for product notifications
Salesforce, Inc. (Heroku)USCloud services provider
Snowflake, Inc.USCloud database provider
SoftServe, Inc.BG, PL, USCustomer service, outsourced engineering and technical support
Telus, Inc.ROCustomer service
Tenable Holdings, Inc.US—
Twilio Inc.USCommunications technology provider for product notifications
Twilio, Inc (Twilio-Segment)USData analytics service
Vonage APIs (formerly Nexmo, Inc.)US, GB, SGCommunications technology provider
Work OS, Inc.USSCIM provisioning
ZendeskUSCustomer service and technical support
Atlassian's own group companies listed as subprocessors (15)
CompanyCountryPurpose
Atlassian (UK) Operations Ltd.GBTechnical and operational support to customers
Atlassian B.V.NLTechnical and operational support to customers
Atlassian Canada Inc.CATechnical and operational support to customers
Atlassian France S.A.S.FRTechnical and operational support to customers
Atlassian Germany GmbHDETechnical and operational support to customers
Atlassian India LLPINTechnical and operational support to customers
Atlassian K.K.JPTechnical and operational support to customers
Atlassian Korea Ltd.KRTechnical and operational support to customers
Atlassian New ZealandNZTechnical and operational support to customers
Atlassian Philippines, Inc.PHTechnical and operational support to customers
Atlassian Poland sp.z.o.oPLTechnical and operational support to customers
Atlassian Pte. Ltd.SGTechnical and operational support to customers
Atlassian Pty. Ltd.AUTechnical and operational support to customers
Atlassian US, Inc.USTechnical and operational support to customers
Opsgenie Yazılım Anonim ŞirketiTRTechnical and operational support to customers

The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.

Every subprocessor in the registry, and which vendors name it: subprocessors.

Processing terms

From the vendor's data processing agreement · read 2026-10-09 · atlassian.com

TermWhat the agreement says
Transfer mechanismEU-U.S. DPF
Transfer mechanismSCC module 2
Transfer mechanismSCC module 3
Transfer mechanismSwiss FADP clauses
Transfer mechanismUK Addendum
Notice of new subprocessorsNotice to subscribed customers (via sub-processors page sign-up) before the new sub-processor is authorized; no period stated
Notice of new subprocessorsPrior notice of Sub-processor changes (SCC Clause 9 Option 2); period as stated in Section 4 (Sub-processing) of the DPA
Notice of new subprocessorsat least 30 days, by email to subscribers of the Sub-processor list notifications
If you object to oneMay object during the notice period; sole and exclusive remedy is to terminate the affected Order (Cloud Product and related services) under Section 12.2 Termination for Convenience
Obligations passed to subprocessorsWritten agreement with each Sub-processor imposing data protection terms to the standard of Applicable Data Protection Law and the same standard as this DPA; Atlassian remains liable for Sub-processor failures
Breach notificationwithout undue delay and, where feasible, within 72 hours of becoming aware
Deletion when the service endsDelete all Customer Personal Data after expiration or termination, per the Documentation; may retain data as required by Applicable Data Protection Law or under standard backup or record retention policies, keeping it confidential and not further processing it
Getting your data backDuring the Subscription Term, Customer and its Users can access and retrieve Customer Personal Data through Cloud Product features
Requests from data subjectsReasonable and timely assistance to Customer in responding to data subject rights requests; inquiries from data subjects received by Atlassian are redirected to Customer
AuditOn-site audit only if the reports are insufficient or required by law/regulator; at customer's expense; at least 60 calendar days' written notice; no more than once every 12 months; during business hours
AuditThird-party/internal audit reports: summary copy provided on request, subject to an NDA; written responses to reasonable information requests, no more than once every 12 months
Transfer impact assessmentInformation to help customers conduct data transfer impact assessments is published (linked)
Processing on your instructionsonly in accordance with Customer's Documented Instructions (DPA, Agreement, Orders and Customer's use/configuration of the Products)
Confidentiality of staffpersonnel authorized to process personal data bound by written or statutory confidentiality obligations
Security measuresappropriate technical and organizational measures to protect Customer Data and protect against Security Incidents; current measures described on a linked page; updates may not materially decrease overall security

Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.

Which version applies

On 2026-11-09, the agreement printed: Effective starting: August 17, 2026 at atlassian.com

In effect from 2026-08-17

This version is in our copies from 2026-10-09.

These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.

AI and your data

What Atlassian's own pages state about the data you send its AI products, plan by plan. Compared with other vendors on AI vendors and your data.

PlansTermWhat the page saysSourceObserved
Business
Rovo		Training on your dataNot used Third-party LLM providers do not use inputs and outputs to train or improve their services; Atlassian may use de-identified, aggregated metadata to fine-tune Atlassian-hosted open-source models, subject to data contribution settingsatlassian.com2026-10-28
Business
Rovo and Atlassian Intelligence		Training on your dataNot used customer data not shared with third-party AI providers for training; Atlassian may use de-identified, aggregated metadata to fine-tune open-source models in its own infrastructure, subject to data contribution settingssupport.atlassian.com2026-10-28
Business
Rovo		Zero data retentionWith its model providers Third-party hosted LLM partners operate under zero data retention agreementsatlassian.com2026-10-28
Business
Rovo		Model providersAnthropicatlassian.com2026-10-28
Business
Rovo		Model providersGoogleatlassian.com2026-10-28
Business
Rovo		Model providersOpenAIatlassian.com2026-10-28

Assurance

Does Atlassian have a SOC 2 report?

Atlassian says a SOC 2 Type 2 report is available on request. We read this on 2026-10-19.

  • Available on request “For now the SOC 2 report and Bridge Letter available under the Compliance Reports folder are the most current, and valid through the end of the year.”
  • Available on request “Jira SOC 2 Type 2 + HIPAA Report”
  • Claimed “It covers how Guard is secured and independently verified (SOC 2, ISO 27001)”
  • Claimed “compliance certifications (SOC 2, ISO 27001, GDPR)”
  • Claimed “Atlassian is currently in the process of issuing our updated FY26 SOC 2 Type 2 reports, covering the audit review period from October 1, 2024, to September 30, 2025.”

Source: customertrust.atlassian.com, 2026-10-19

Of the 114 vendors in this registry whose own pages mention SOC 2, 57 say the report is available on request, 1 links to the report itself, and 56 state it without saying how to get it. The type is the one the vendor names.

Is Atlassian ISO 27001 certified?

Atlassian states ISO/IEC 27001 certification, and says the certificate or audit report is available on request. We read this on 2026-10-19.

  • Available on request “ISO 27001 Certificate”
  • Claimed “It covers how Guard is secured and independently verified (SOC 2, ISO 27001)”
  • Claimed “compliance certifications (SOC 2, ISO 27001, GDPR)”

Source: customertrust.atlassian.com, 2026-10-19

On the same list Atlassian also names ISO/IEC 27018. Each standard's page says how it relates to ISO/IEC 27001.

Of the 122 vendors in this registry whose own pages state ISO/IEC 27001, 16 link to the certificate, 43 say it is available on request, and 63 state it without saying how to get it. A certificate names the certification body, the scope and the expiry date: those are the three things to check.

SchemeStatusScopeSourceObserved
C5Available on requestAssessment Lettercustomertrust.atlassian.com2026-10-19
DORAClaimedguidance on how Atlassian addresses key DORA requirementscustomertrust.atlassian.com2026-10-19
EU-US DPF · DPFClaimed—customertrust.atlassian.com2026-10-19
FedRAMPClaimed—customertrust.atlassian.com2026-10-19
GDPRClaimedLoom AIcustomertrust.atlassian.com2026-10-19
GovRAMPClaimed—customertrust.atlassian.com2026-10-19
HIPAAAvailable on requestJiracustomertrust.atlassian.com2026-10-19
ISO 27001 · ISO27001Available on request—customertrust.atlassian.com2026-10-19
ISO 27001 · ISO27001ClaimedAtlassian Guardcustomertrust.atlassian.com2026-10-19
ISO 27001 · ISO27001ClaimedLoom AIcustomertrust.atlassian.com2026-10-19
ISO 27018 · ISO27018Claimed—customertrust.atlassian.com2026-10-19
ISO/IEC 42001:2023 · ISO42001Available on requestRovo; Artificial Intelligence Management System (AIMS) supporting the design, development, deployment, operation, and continual improvement of Rovocustomertrust.atlassian.com2026-10-19
SOC 1 Type 2 · SOC1Available on requestJira, JSM, and Confluencecustomertrust.atlassian.com2026-10-19
SOC 1 Type II · SOC1Claimed—customertrust.atlassian.com2026-10-19
SOC 2 · SOC2ClaimedAtlassian Guardcustomertrust.atlassian.com2026-10-19
SOC 2 · SOC2ClaimedLoom AIcustomertrust.atlassian.com2026-10-19
SOC 2 · SOC2Available on requestSOC 2 report and Bridge Letter available under the Compliance Reports foldercustomertrust.atlassian.com2026-10-19
SOC 2 Type 2 · SOC2T2Available on requestJiracustomertrust.atlassian.com2026-10-19
SOC 2 Type 2 · SOC2T2Claimedupdated FY26 reports covering the audit review period from October 1, 2024, to September 30, 2025; expected to be issued by end of December 2025customertrust.atlassian.com2026-10-19
SOC 2 Type II · SOC2T2Claimed—customertrust.atlassian.com2026-10-19
TISAXClaimed—customertrust.atlassian.com2026-10-19
VPATClaimed—customertrust.atlassian.com2026-10-19

Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.

SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.

Official registers

RegisterOffering, as the register names itStatusLevelValid untilObserved
Data Privacy Framework List (US)EU-U.S. Data Privacy Framework · Atlassian, Inc.Activenon-HR data2027-04-282026-10-05
Data Privacy Framework List (US)Swiss-U.S. Data Privacy Framework · Atlassian, Inc.Activenon-HR data2027-04-282026-10-05
Data Privacy Framework List (US)UK Extension to the EU-U.S. DPF · Atlassian, Inc.Activenon-HR data2027-04-282026-10-05
FedRAMP Marketplace (US)Atlassian Government Cloud · AtlassianFedRAMP AuthorizedModerate—2026-10-04
Global LEI Index (GLEIF)ATLASSIAN PTY LTD · ATLASSIAN PTY LTDISSUEDAU2026-10-242026-10-08

What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.

What an entry on the Data Privacy Framework List covers, and which vendors hold one: EU-US Data Privacy Framework.

Support window

ProductSupport periodStateSBOMSourceObserved
Bitbucket 10.424 monthsDeclaredunknownconfluence.atlassian.com2026-10-11
Confluence 11.024 monthsDeclaredunknownconfluence.atlassian.com2026-10-11
Jira Software 11.324 monthsDeclaredunknownconfluence.atlassian.com2026-10-11

Vulnerability reporting: atlassian.com, [email protected] (security.txt, expires 2027-02-04; read 2026-10-17)

How other vendors publish theirs: security.txt across the registry.

Products

As Atlassian's own list names them. Each fact on this page comes from the document cited beside it; a product named here is not necessarily covered by every one of those documents. Source: atlassian.com, 2026-10-29.

Documents

Where is Atlassian's trust center?

Atlassian publishes a page it calls “Trust Center” at customertrust.atlassian.com. Some of its documents sit behind a request or sign-in. The page mentions SOC 2, ISO 27001, a penetration test, subprocessors and a DPA. We read it on 2026-11-03. Open customertrust.atlassian.com

  • Name “Trust Center”
  • Request step “Get Access”

Source: customertrust.atlassian.com, 2026-11-03. Read from the page's text, without a model; every vendor's trust center.

What we read, how it was disclosed, and when.
DocumentDisclosureTranscriptionHTTPObserved
aiPublicfull2002026-10-28
ai-2Publicfull2002026-10-28
certificationsPublicfull2002026-10-19
dpaPublicfull2002026-10-09
lifecyclePublicfull2002026-10-11
productsPublicfull2002026-10-29
subprocessorsPublicfull2002026-10-05
tiaPublicfull2002026-10-20

History

DetectedWhat movedWhySource
2026-09-18
EU data location Enterprise only → Paid upgrade
Minimum plan set to Standard, Premium or Enterprise
Note rewritten
we read a better pagesupport.atlassian.com

Every reviewed change across the registry, newest first: vendor changes.