Marketplace App Trust | Atlassian

·Marketplace App Trust

·Customize freely. Scale securely.

·Extend your Atlassian platform with confidence

·Customizing your digital workplace should be seamless, powerful, and secure. Whether you're adding your first workflow integration or scaling tools across multiple departments, the Atlassian Marketplace delivers specialized solutions with security built right in.

·Trust isn't an add-on in our Marketplace-it's the foundation. With platform guardrails, continuous automated monitoring, and rigorous trust programs, your teams can move quickly and work with confidence.

·Setting a privacy & security baseline

·Atlassian enforces comprehensive security and privacy standards across the Atlassian Marketplace through platform-level baselines, continuous automated oversight, and third-party security initiatives.

·Mandatory Security Baselines for Cloud Apps

·Every Marketplace cloud app must adhere to Atlassian's mandatory app security requirements. Governed by comprehensive security assessments during initial listing and ongoing updates, these requirements enforce active risk reduction and ensure platform-wide adherence to security best practices.

·Maintaining security through continuous scanning

·Atlassian centrally manages a comprehensive vulnerability scanning and management program powered by our proprietary Ecoscanner platform. Ecoscanner performs ongoing automated security checks across all Marketplace cloud apps-proactively screening for supply chain risks, malware, static code vulnerabilities, and security misconfigurations while continuously evaluating configuration hygiene.

·If an app fails to meet any security requirement, Atlassian initiates immediate remediation.

·Timely resolution of security issues

·To ensure swift resolution of any identified risks, Marketplace Partners are contractually required to adhere to strict security bug-fix SLAs aligned with Atlassian's internal standards, remediating and deploying fixes within mandatory, defined timelines.

·Proactive Crowdsourced Defense via Bug Bounty

·Through Atlassian's ecosystem Bug Bounty program, partners engage vetted security researchers to uncover and remediate vulnerabilities early. Running public programs establishes a transparent, documented, and incentivized channel for responsible vulnerability disclosure. While optional across the broader Marketplace, participation in bug bounties is mandatory for apps to qualify for Cloud Fortified and Atlassian Enterprise Certified badges.

·Ensuring transparency through privacy requirements

·All Marketplace Partners must publish a comprehensive Privacy Policy detailing their data collection, processing, storage, and retention practices-including sub-processor transparency and geographic data storage. Furthermore, Atlassian requires partners to maintain explicit end-user consents and adhere to strict data-handling obligations under the Atlassian Developer Terms.

·Specialized application penetration testing

·Atlassian centrally manages the Marketplace Penetration Testing Program connecting Marketplace Partners with CREST-certified security experts for deep, platform-tailored testing. The program streamlines scoping, vulnerability logging, and remediation tracking to uncover complex attack vectors before they impact production environments. Customers can easily discover participating apps using the Penetration Testing filter on the Atlassian Marketplace.

·Find apps built for your highest security and reliability standards

·Every app on the Atlassian Marketplace meets our foundational cloud requirements for security, reliability, and performance. For teams with advanced governance needs, badges like Atlassian Enterprise Certified and Runs on Atlassian help you easily identify apps that have gone above and beyond Atlassian's baseline standards to deliver a secure and reliable cloud experience.

·The requirements for each badge are as follows:

·Atlassian Enterprise Certified

·The Atlassian Enterprise Certified badge highlights Marketplace apps that meet common enterprise needs for compliance, security, reliability, privacy, accessibility, and responsible AI use.

·Runs on Atlassian

·Runs on Atlassian (RoA) apps are hosted on the Forge platform, limit data egress, and offer data residency. Learn more here or view RoA apps here

·Cloud Fortified

·Cloud Fortified apps demonstrate an extra layer of trust through Bug Bounty participation, reliability at scale, and dedicated 24/5 critical support.

·Note: This badge will be sunsetted as of December 31st, 2026.

·The Shared Responsibility Model: Trust in Practice

·Building a secure digital workplace is a collaborative partnership across three key pillars:

·Marketplace Partners

·Marketplace partners design apps and operational processes according to their legal obligations, Atlassian's requirements, and general industry best practices for reliable, compliant, and secure apps.

·Atlassian

·Atlassian provides information and capabilities to help Marketplace Partners build trustworthy apps, while giving customers the centralized visibility, transparency, and controls needed to vet and govern them confidently.

·You

·You are responsible for assessing app suitability and reviewing partner policies. Installing an app establishes a separate, direct relationship between your organization and the third-party partner.

·Atlassian enforces comprehensive security and privacy standards across the Atlassian Marketplace through platform-level baselines, continuous automated oversight, and third-party security initiatives.

·Frequently asked questions

·Trust & Security Community

·Join the Trust & Security group on the Atlassian Community to receive information, tips, and best practices for using Atlassian products in a secure and reliable way.