Data protection in the Atlassian Cloud

In autumn 2020, Atlassian announced the consolidation of its licensing offering and is now focusing on further developing its products on the Data Centre and Atlassian Cloud platforms. As a result, many (Server) customers are evaluating which option is best for their organisation. When considering the various issues, a number of questions arise, particularly regarding data protection in Atlassian Cloud. Where and how is the data stored? Can Atlassian Cloud be used in a way that complies with the GDPR? What options are available?

In this blog post, we have summarised the answers to key questions on the topic of data protection.

Disclaimer: Communardo GmbH cannot provide legal advice. Please check and assess individually with your data protection officer whether Atlassian Cloud is suitable for your organisation. Furthermore, we update this blog post regularly as soon as there is any news on the subject. The last update was in June 2022.

We’d be happy to support you in your decision-making process, drawing on our many years of experience with Atlassian Cloud, and are always on hand to offer advice thanks to our ongoing dialogue with qualified data protection officers. If you have any questions or are interested in a cloud migration, we’d be happy to help. Simply get in touch with us.

Where does Atlassian store data from Jira and Confluence Cloud?

Atlassian Cloud data is hosted on Amazon Web Services (AWS) in the United States, Germany, Ireland, Singapore and Australia.

Where is which datastored?

By default, Atlassian uses all of the aforementioned data centres (data residency: global). However, customers can also choose a different data residency (e.g. EU) if they wish.
This means that most data is stored only on EU servers (Frankfurt am Main and Dublin).
This feature is available to all paying customers (Standard, Premium, Enterprise).

Data residency in Germany is now officially on the Atlassian Cloud Roadmap for Q1/Q2 2023.

The following data can be assigned to a specific region (e.g. the EU):

Jira Software data:

• All attachments
• Board and sprint data
• Comments
• Notification data within the product
• Jira issue and field contents (including system and user-defined fields)
• Jira search data
• Project configuration data (including workflows, custom field configuration and board configuration)

Jira Service Management data:

• All attachments
• Comments
• In-product notification data
• Insight object data and schema configuration data
• Jira issues, request types and field contents (including system and user-defined fields)
• Jira search data
• Project configuration data (including workflows and custom field configuration)
• Queue data

Confluence data:

• Confluence pages and blog data
• All attachments
• Comments
• 'Likes' on pages and comments
• Notification data within the product
• Page metadata
• Source data for notifications in emails

Some data (e.g. analytics data) is currently hosted in the USA or cannot be restricted to a specific region. A detailed overview is provided here.

How can you specify where the data is stored?

Organisation administrators can check which data residency option is currently active under ‘Security’ at admin.atlassian.com.
If you wish to change this (e.g. from ‘global’ to ‘EU’), please feel free to contact Atlassian or us.

Tip: If you set up your Cloud site via Communardo, you’ll receive EU data residency free of charge from day one.

How can Jira and Confluence Cloud be used in compliance with the GDPR?

Atlassian already has a range of compliance features in place, such as SOC 2, PCI DSS and ISO 27001/27018. Data is transmitted and stored in encrypted form. The existing certifications cover many of the security and data protection requirements of the GDPR. To ensure compliance with the GDPR, a Data Processing Agreement (DPA) – in English: Data Processing Addendum – which explicitly incorporates the EU’s Standard Contractual Clauses (SCCs). The agreement, signed by Atlassian, is available for download on the website. Once your organisation has countersigned the agreement and returned it to Atlassian, the agreement becomes binding and the Atlassian Cloud can be used in compliance with the GDPR.

Where is the app data stored?

The app provider is responsible for the storage and processing of data from Cloud Apps. The providers make this information available on the Atlassian Marketplace under ‘Privacy and security’ in the ‘Vendor privacy policy’ section. If the provider’s terms and conditions do not answer your questions, we recommend contacting the provider directly. The manufacturer’s contact details can be found in the Marketplace under the ‘Support’ tab.

At present, some Marketplace apps and app data are not covered by Atlassian’s data residency guarantee. Work is currently underway to make this possible. Atlassian publishes updates on this in its Cloud Roadmap (title: Data Residency for Apps).

Our conclusion

It is possible to use both Jira and Confluence in the Atlassian Cloud in a way that complies with data protection regulations. However, you should bear in mind that data protection is an issue that each company should assess on a case-by-case basis. For further research, we have provided a list of links below:

• Atlassian Cloud Roadmap for data management
• Overview of which data is stored where
• Atlassian compliance certifications
• Supplementary Agreement on Data Processing
• Information on data protection, compliance and security
• Atlassian GDPR Commitment

We are an Atlassian Platinum Partner and Enterprise Solution Partner, and we are happy to support your specific data protection requirements with our many years of experience. 

Ready for the next step? Let’s work together to find out whether your business is ready for the cloud.