• ·Legal information Security measures

·Atlassian's Technical and Organisational Security Measures

·Download PDF Effective starting: October 7, 2025

·Introduction

·Security is an essential part of Atlassian's offerings. This page describes Atlassian's security program, certifications, policies, and physical, technical, organizational and administrative controls and measures to protect Customer Data and, where indicated below, Customer Materials from unauthorized access, destruction, use, modification or disclosure (the "Security Measures"). The Security Measures are consistent with the commonly-accepted industry standards and practices, including NIST 800-53 controls.

·Any capitalized terms used but not defined have the meanings set out in the Agreement or the Data Processing Addendum. Further details on Atlassian's security posture can be found in our Trust Center and Compliance Resource Center.

11. Access Control

·Atlassian maintains a comprehensive set of formal policies, controls, and practices for the appropriate access control when processing Customer Data and Customer Materials, which includes:

1.11.1. access management policy addressing access control standards, including the framework and the principles for user provisioning;

1.21.2. designated criticality tiers based on a Zero Trust Model architecture, including the requirements for multi-factor authentication on higher-tier services;

1.31.3. user provisioning for access to Atlassian systems, applications and infrastructure based on the relevant job role and on the least privilege principle that is enforced through the authentication processes, enabling only authorized personnel to have access to development and build environments (including source code repositories) associated with the Products;

1.41.4. strict role-based access controls for Atlassian staff, allowing access to Customer Data only on a need-to-know basis;

1.51.5. segregation of duties including but not limited to (i) access controls reviews, (ii) HR-application managed security groups, and (iii) workflow controls;

1.61.6. a prior approval of all user accounts by Atlassian's management before granting access to data, applications, infrastructure, or network components based on the data classification level; regular review of access rights as required by relevant role;

1.71.7. use of technical controls such as virtual private network (VPN) and multi-factor authentication (MFA) where relevant based on information classification and Atlassian's Zero Trust Model architecture;

1.81.8. centrally managed mobile device management (MDM) solution, including defined lockout periods and posture checks for endpoints and mobile devices;

1.91.9. identifying and removing redundant and dormant accounts, promptly revoking access through automated and regular review processes.

22. Awareness and Training

·Atlassian maintains a comprehensive set of formal policies, controls, and practices for conducting appropriate trainings and security awareness activities, which includes:

2.12.1. extensive awareness training on security, privacy, and compliance topics for all employees at induction and annually, utilizing diverse formats (online, in-person, and pre-recorded sessions, phishing simulations);

2.22.2. targeted role-specific training and documentation for employees with elevated privileges to address relevant risks and enhance their specific knowledge as required for their respective roles;

2.32.3. maintaining all training records in a designated learning management system;

2.42.4. an automated reminder for training deadlines, with a built-in escalation process to respective managers;

2.52.5. continuous security awareness trainings (extending to contractors and partners), covering current threats and best security practices;

2.62.6. secure coding trainings by security champions embedded within engineering teams;

2.72.7. annual mandatory security trainings and events to reinforce security principles through different activities, emphasizing the collective responsibility for security;

2.82.8. annual secure development training to Atlassian developers in alignment with industry standards.

33. Audit and Accountability

·Atlassian maintains a comprehensive set of formal policies, controls, and practices for proper auditing and accountability purposes, which includes:

3.13.1. comprehensive logging standards as part of Atlassian's policy management framework, with annual reviews and senior management approvals;

3.23.2. secure forwarding and storage of relevant system logs to a centralized log platform of the cloud infrastructure with read-only access;

3.33.3. monitoring of security audit logs to detect unusual activity, with established processes for reviewing and addressing anomalies;

3.43.4. regular updates to the logging scope of information and system events for Cloud Products and related infrastructure in order to address new features and changes;

3.53.5. utilizing time sync services from relevant cloud service providers (e.g. AWS or Microsoft Azure) for reliable timekeeping across all deployed instances.

44. Assessment, Authorisation and Monitoring

·Atlassian maintains a comprehensive set of formal policies, controls, and practices for consistent system monitoring and security assessments, which includes:

4.14.1. extensive audit and assurance policies with annual reviews and updates;

4.24.2. a centralized internal policy program categorising the global policies into different domains including annual review, and senior management approval of the program;

4.34.3. audit management encompassing the planning, risk analysis, security control assessment, conclusion, remediation schedules, and review of past audit reports;

4.44.4. internal and independent external audits conducting annual evaluations of legal and contractual requirements, as well as effectiveness of controls and processes to validate compliance;

4.54.5. ongoing verification of compliance against relevant standards and regulations, e.g. ISO 27001 or SOC 2;

4.64.6. systematically addressing any nonconformities found through audit findings taking into account the root-cause analysis, severity rating, and corrective actions;

4.74.7. annual penetration testing on Cloud and Software Products and proactive bug bounty programs for the detection and mitigation of vulnerabilities;

4.84.8. continuous vulnerability scanning consistent with commonly-accepted standards and practices for security testing with subsequent remediation of identified vulnerabilities based on the Common Vulnerability Scoring System (CVSS) in line with Atlassian's Security Bugfix Policy;

4.94.9. security testing, privacy risk and vulnerability assessments of the relevant Cloud Products and processes at least annually.

55. Configuration Management

·Atlassian maintains a comprehensive set of formal policies, controls, and practices for appropriate configuration management, which includes:

5.15.1. change management policies covering the risk management for all internal and external asset changes, reviewed annually;

5.25.2. standard procedures for change management applicable to encryption and cryptography for the secure handling of data (e.g. encryption keys) according to its security classification, including but not limited to key rotation, defining key ownership, secure storage;

5.35.3. a centralized internal policy program categorising the global policies into different domains including annual review, and senior management approval of the program;

5.45.4. stringent policies encompassing (i) encryption, (ii) cryptography, (iii) endpoint management, and (iv) asset tracking inline with industry standards;

5.55.5. established baselines and standards for change control that require testing documentation prior to implementation and authorized approval;

5.65.6. a peer review and green build process requiring multiple reviews and successful testing for production code and infrastructure changes;

5.75.7. a strict post-implementation testing and approval process for emergency changes to the code;

5.85.8. comprehensive automated system supplemented by an Intrusion Detection System (IDS), managing and protecting against unauthorized changes;

5.95.9. cataloguing and tracking of all physical and logical assets with annual reviews ensuring up-to-date asset management;

5.105.10. continuous monitoring and managing the health (including capacity) and availability of assets and Cloud Products, including their underlying components.

66. Contingency Planning

·Atlassian maintains a comprehensive set of formal policies, controls, and practices for appropriate contingency planning for business continuity and disaster recovery purposes, which includes:

6.16.1. a skilled workforce and robust IT infrastructure, including telecommunications and technology essential for Product delivery;

6.26.2. business continuity and disaster recovery plans ("BCDR Plans"), including defined recovery time objectives (RTOs) and recovery point objectives (RPOs);

6.36.3. business continuity plans encompassing data storage and continuity of use, reasonably designed to prevent interruption to access and utilization;

6.46.4. geographic diversity as a result of our global workforce and cloud infrastructure;

6.56.5. reinforcing business operations through resilience controls, such as daily backups, annual restoration testing, and alternative cloud infrastructure storage sites;

6.66.6. a resilience framework and procedures for response and remediation of cybersecurity events in order to maintain business continuity;

6.76.7. quarterly disaster recovery tests and exercises to enhance response strategies, with post-test analyses for continuous improvement aligned with applicable BCDR Plans;

6.86.8. continuous capacity management across Cloud Products, with internal monitoring and adjustments to maintain service availability and processing capacity, for example distributed denial-of-service attack (DDoS) mitigation for Cloud Products and related infrastructure;

6.96.9. a centralized internal policy program for annual reviews and updates of all global policies related to business continuity;

6.106.10. robust backup protocols, including (i) data encryption, (ii) redundancy across data centers, and (iii) regular testing to bolster contingency planning.

77. Identification and Authentication

·Atlassian maintains a comprehensive set of formal policies, controls, and practices for appropriate identification and authentication purposes which includes:

7.17.1. employee identification uniquely through active directory, utilising single sign-on (SSO) for application access;

7.27.2. utilising of MFA for secure access, specifically for VPN and application launch via SSO based on Atlassian's Zero Trust Model architecture;

7.37.3. password policies following the NIST 800-63B guidelines, focusing on the security aspects of password creation and management;

7.47.4. ensuring the security of stored credentials using advanced encryption methods, e.g. password and secret management systems;

7.57.5. documented approvals, regular reviews of users and accounts, and automatic syncs between the relevant identity system and human resources systems to maintain the integrity and accuracy of identification data.

88. Security Incident Response

·Atlassian maintains a comprehensive set of formal policies, controls, and practices for appropriate Security Incident response purposes, which includes:

8.18.1. security Incident response plans emphasizing preparedness, containment, eradication and recovery, as well as focus on data protection and other regulatory requirements;

8.28.2. dedicated cross-functional teams handling Security Incidents, ensuring effective communication and collaboration, including well-defined processes for triaging security events;

8.38.3. regular testing of response plans with established metrics to track and improve Security Incident management effectiveness;

8.48.4. annual reviews of company-wide incident response plans and policies to reflect and share current best practices across the company;

8.58.5. post-incident review with root cause analysis conducted for high-severity Security Incidents, focusing on systemic improvements and learning;

8.68.6. incident response procedures and plans embedded in critical business processes to minimize downtime and security risks;

8.78.7. published system availability information to aid in Security Incident handling and reporting at https://status.atlassian.com/ , and https://www.loomstatus.com/, as applicable;

8.88.8. the ability for Customer to report incidents, vulnerabilities, bugs, and issues, ensuring prompt attention to concerns related to system defects, availability, security, and confidentiality;

8.98.9. commitment to Customer notification of the Security Incident without undue delay as set forth in Atlassian's Data Processing Addendum, including the obligation to promptly assist the Customer with necessary information for compliance with Applicable Data Protection Laws.

99. Maintenance

·Atlassian maintains a comprehensive set of formal policies, controls, and practices for continued effectiveness of its Cloud Products, which includes:

9.19.1. regular testing of BCDR Plans with quarterly evaluations, validated by external auditors;

9.29.2. real-time monitoring of the availability of multiple regions with performing of regular tests for infrastructure availability and reliability;

9.39.3. measures outlined in Section 4 (Assessment, Authorisation and Monitoring), Section 6 (Contingency Planning) and Section 18 (System and Communications Protection).

1010. Media Protection

·Atlassian maintains a comprehensive set of formal policies, controls, and practices to ensure the protection of media (internal and external), which includes:

10.110.1. using reliable third party services (e.g. Microsoft Azure or AWS) to operate the physical infrastructure for processing Customer Data as a Sub-processor;

10.210.2. sanitization and degaussing of used equipment by the third party cloud service providers, including hard drives with Customer Data in line with industry standards (e.g. NIST 800-88);

10.310.3. full disk encryption using industry standards (e.g. AES-256) employed for data drives on servers and databases storing Customer Data, Customer Materials, and on endpoint devices;

10.410.4. access to Customer Data and Customer Materials is strictly limited to Atlassian-owned machines configured under a mobile device management solution, following Atlassian's Zero Trust Model architecture;

10.510.5. internal bring your own device (BYOD) policy ensuring that access to permitted Atlassian networks and systems is only possible via secure and compliant devices;

10.610.6. unattended workspaces are required to have no visible confidential data, aligning with the secure workplace guidance.

1111. Physical and Environmental Protection

·Atlassian maintains a comprehensive set of formal policies, controls, and practices for the physical and environmental protection of Customer Data and Customer Materials, which includes:

11.111.1. a safe and secure working environment with controls implemented globally at Atlassian's offices;

11.211.2. employing badge readers, camera surveillance, and time-specific access restrictions for enhanced security;

11.311.3. implementing and maintaining access logs at office buildings for investigative purposes;

11.411.4. multiple compliance certifications and robust physical security measures, including biometric identity verification and on-premise security, implemented by third party data center providers;

11.511.5. controlled access points and advanced surveillance systems as well as protective measures for power and telecommunication cables, alongside with environmental control systems, implemented by third party data center providers;

11.611.6. positioning critical equipment in low-risk environmental areas for added safety (both by Atlassian and its third party data center providers);

11.711.7. precautions to protect physical infrastructure of facilities where Customer Data or Customer Materials are hosted or otherwise processed against environmental threats, both naturally occurring and man-made, such as excessive ambient temperature, fire, flood, humidity, theft, and vandalism.

1212. Planning

·Atlassian maintains a comprehensive set of formal policies, controls, and practices for appropriate planning of business operations, which includes:

12.112.1. active monitoring and documentation by legal and compliance teams on regulatory obligations;

12.212.2. a detailed system security plan with comprehensive documentation on system boundaries and product descriptions;

12.312.3. communication to internal users and customers about significant changes to key products and services;

12.412.4. periodic reviews and updates of the security management program.

1313. Program Management

·Atlassian maintains a comprehensive set of formal policies, controls, and practices for appropriate program management, which includes:

13.113.1. supporting the security management program at the executive level, encompassing all security-related policies and practices;

13.213.2. documented information security policies, including (i) defined roles, (ii) risk mitigation, and (iii) service provider security management program;

13.313.3. periodic risk assessments of systems processing Customer Data, with prompt reviews of Security Incidents for corrective action;

13.413.4. formal security controls framework aligning to standards such as SOC 2, ISO27001, and NIST 800-53;

13.513.5. processes for identifying and quantifying security risks, with mitigation plans approved by the Chief Trust Officer and regular tracking of implementation;

13.613.6. comprehensive and diverse approach to security testing to cover a wide range of potential attack vectors;

13.713.7. regular review, testing and updating of the information security management program and policies integral to Atlassian's business (annually, at a minimum);

13.813.8. an information security management program that requires security by design approach, secure development, secure engineering, and secure operations that are consistent with industry standards;

13.913.9. development program for security staff with regular trainings; organizational chart that delineates roles and responsibilities;

13.1013.10. setting and review of strategic operational objectives by the executive management;

13.1113.11. annual review of the Enterprise Risk Management (ERM) framework, including the risk management policy, risk assessments, and fraud risk assessments, by the Head of Risk and Compliance.

1414. Personnel Security

·Atlassian maintains a comprehensive set of formal policies, controls and practices for the security of all Atlassian's employees who have access to Customer Data and Customer Materials, which includes:

14.114.1. pre-hire background checks, including criminal record inquiries, for all in-scope employees, with heightened reviews performed for senior executive and accounting roles to the extent permissible under applicable local laws;

14.214.2. an onboarding process that includes in-scope employees' execution of confidentiality agreements, employment contracts, and acknowledgement of applicable policies and codes of conduct;

14.314.3. global and local employment policies, maintained and reviewed annually;

14.414.4. processes for role changes and terminations including automatic de-provisioning and checklists for employee exits, with managerial approval required for re-provisioning the access;

14.514.5. ongoing security and compliance training for employees, with targeted training for specific roles and the presence of security champions in teams;

14.614.6. established disciplinary processes to manage violations of Atlassian's policies.

1515. Personal Data Processing and Transparency

·Atlassian maintains a comprehensive set of formal policies, controls, and practices for the compliance of personal data processing in line with Applicable Data Protection Laws, which includes:

15.115.1. a global privacy compliance program for reviewing and adapting to applicable data protection laws including necessary safeguards and processes;

15.215.2. maintaining an internal personal data processing policy with clear definitions of personal data categories, processing purposes, and processing principles;

15.315.3. detailed standards for processing of various categories of personal data covering the topics such as processing principles, applicable legal basis, privacy by design/by default principles, retention, and destruction;

15.415.4. an established method to create pseudonymised data sets using industry standard practices and appropriate technical and organisational measures governing the systems capable of remapping pseudonymous identifiers;

15.515.5. transparent privacy policies for its users and customers, as well as internal guidelines for employees;

15.615.6. comprehensive compliance documentation, including but not limited to, and where applicable, (i) a record of processing activities, (ii) privacy impact assessments, (iii) transfer impact assessments, (iv) consents, and (v) data processing agreements with customers and vendors;

15.715.7. secure development practices across all development lifecycle stages, focusing on security and data protection from the initial design phase;

15.815.8. ensuring Atlassian's compliance with data subjects' rights to access, correct, and delete their personal data in accordance with applicable data protection laws.

1616. Risk Assessment

·Atlassian maintains a comprehensive set of formal policies, controls, and practices for a robust Information Security Management System, which includes:

16.116.1. a comprehensive risk management program for identifying, assessing, and addressing various risks to support informed risk management decisions;

16.216.2. a policy program aligning company-wide policies with ISO 27001 and other relevant standards to mitigate associated risks;

16.316.3. continuous security testing and vulnerability identification, including (i) penetration tests, (ii) bug bounties, and (iii) proactive threat mitigation;

16.416.4. processes and metrics for reporting vulnerability management activities;

16.516.5. thorough security evaluations, including independent external and internal audits.

1717. System and Services Acquisition

·Atlassian maintains a structured, security-centric methodology for the system development, maintenance, and change management, which includes:

17.117.1. an agile secure software development life cycle, including the review and documentation of system and infrastructure changes;

17.217.2. secure, standardized application deployment with automated processes for system configuration changes and deployment;

17.317.3. defined development process with peer-reviewed pull requests and mandatory automated tests prior to merging;

17.417.4. segregated responsibilities for change management among designated employees;

17.517.5. emergency change processes, including "break glass" procedures, ensuring readiness for rapid response during critical incidents;

17.617.6. robust compliance settings in Atlassian's source code and deployment systems preventing unauthorized alterations;

17.717.7. clear documentation and monitoring of all configuration changes, with automatic alerts for non-compliance or alterations in peer review enforcement;

17.817.8. supporting documentation for Cloud and Software Products including instructions on how to securely use and configure them;

17.917.9. strict controls over modifications to vendor software;

17.1017.10. regular scanning and updates of third-party or open-source libraries as well as ongoing scanning of the code base.

1818. System and Communications Protection

·Atlassian maintains a comprehensive set of formal policies, controls, and practices for system and communication protection which includes:

18.118.1. cryptographic mechanisms to safeguard sensitive information stored and transmitted over networks, including public internet, using reliable and secure encryption technologies;

18.218.2. encryption of Customer Data at rest using AES-256 and in transit using Transport Layer Security (TLS) 1.2+ with Perfect Forward Secrecy (PFS) across public networks;

18.318.3. zone restrictions and environment separation limiting connectivity between production and non-production environments;

18.418.4. continuous management of workstation assets including (i) security patch deployment, (ii) password protection, (iii) screen locks, and (iv) drive encryption through asset management software;

18.518.5. restricting access to only known and compliant devices enrolled in the MDM platform, adhering to the principles of Zero Trust Model architecture;

18.618.6. maintaining firewalls at corporate edges for both platform and non-platform hosted devices for additional layers of security;

18.718.7. maintaining network and host defense, including operating system hardening, network segmentation, and data loss prevention technologies;

18.818.8. established measures to ensure Customer Data and Customer Materials are kept logically segregated from other customers' data.

1919. System and Information Integrity

·Atlassian maintains formally established policies and practices that include the following controls and safeguards relevant for system and information integrity, in particular:

19.119.1. adherence to stringent data disposal protocols in line with applicable laws, reasonably ensuring that data from storage media is irrecoverable post-sanitization;

19.219.2. strict policies to prevent the use of production data in non-production environments, ensuring the data integrity and segregation;

19.319.3. centrally managed, read-only system logs; monitoring for Security Incidents; retention policies aligned with security best practices;

19.419.4. generating and retaining logs that record access by Atlassian personnel to Customer Data or Customer Materials with respect to systems used in providing the Products, and protection of such logs against unauthorized access, modification, and accidental or deliberate destruction;

19.519.5. managing endpoint compatibility with systems and applications, enhancing network security and reliability;

19.619.6. deploying anti-malware strategies on the relevant infrastructure and Atlassian devices for robust protection against malware threats with regular updates to malware protection policies and detection tools;

19.719.7. unique identifiers and token-based access control to ensure logical isolation of, and secure, limited access to, Customer Data;

19.819.8. segregation of production and non-production environments;

19.919.9. protection of Customer Data within a sandbox environment (for example, to reproduce an error) utilising similar measures to those in the production environment.

2020. Supply Chain Risk Management

·Atlassian maintains formally established policies and practices for supply chain risk management, which includes:

20.120.1. a formal framework for managing vendor relationships, and aligning the security, availability, and confidentiality standards of suppliers throughout their lifecycles;

20.220.2. a robust third party risk management (TPRM) assessment process including risk assessments, due diligence, contract management, and ongoing monitoring of all third parties;

20.320.3. dedicated teams, including legal, procurement, security, and risk departments for the review of contracts, service level agreements, and security measures to manage risks related to security and data confidentiality;

20.420.4. functional risk assessments of suppliers before onboarding and periodically, based on risk levels, with revisions during policy renewals or significant relationship changes;

20.520.5. an inventory of all suppliers detailing ownership and risk levels associated with the services provided to Atlassian;

20.620.6. annual review of audit reports (e.g. SOC 2) and regular reviews of information technology governance policies and security assessments of supply chain providers to ensure applicable controls are compliant;

20.720.7. measures to secure third-party endpoints, focusing on compliance monitoring and selective restrictions.

·Related content

·Product-specific terms

·Learn more

·Advisory Services

·Learn more

·Data Processing Addendum

·Learn more

·Data Transfer Impact Assessment

·Learn more

·Stay informed

·Subscribe to receive notifications from us about updates to our legal terms (including our legal policies) and our list of sub-processors. Sign up for updates

• ·Legal information Data Processing Addendum Atlassian Data Processing Addendum

·Atlassian Data Processing Addendum

·Download the DPA Effective starting: August 17, 2026

·This Data Processing Addendum ("DPA") supplements the Atlassian Customer Agreement, or other agreement in place between Customer and Atlassian covering Customer's use of Atlassian's Products and related Support and Advisory Services (the "Agreement"). Unless otherwise defined in this DPA or in the Agreement, all capitalized terms used in this DPA will have the meanings given to them in Section 9 of this DPA. Customer enters into this DPA on behalf of itself and in the name and on behalf of its Authorised Affiliates permitted to use the Products and related Support and Advisory Services under the Agreement. For the purposes of this DPA only, the term "Customer" includes Customer and such Authorised Affiliates.

11. Scope and Term

1.11.1 Roles of the Parties. For the purposes of the Agreement, the parties agree that:

·(a) Customer is either a Controller of Customer Data, or a Processor of Customer Data acting on another Controller's behalf (e.g. Customer's Affiliate) while passing down relevant processing instructions to Atlassian. Processing details are stated in Schedule 1 (Description of Processing).

·(b) Atlassian is a Processor (or respectively, a Sub-processor) of Customer Data. Processing details are stated in Schedule 1 (Description of Processing).

1.21.2 Term of the DPA. The term of this DPA coincides with the term of the Agreement and terminates upon expiration or earlier termination of the Agreement (or, if later, the date on which Atlassian ceases all Processing of Customer Personal Data).

1.31.3 Order of Precedence. If there is any conflict or inconsistency among the following documents, the order of precedence from highest to lowest will be: (1) the applicable terms stated in Schedule 2 (Region-Specific Terms including any transfer provisions); (2) Schedule 1 (Description of Processing); (3) the main body of this DPA; and (4) the Agreement.

22. Processing of Personal Data

2.12.1 Customer Instructions.

·(a) This DPA, the Agreement, applicable Orders and Customer's use of the Products (including relevant configurations and settings) and related Support and Advisory Services constitute Customer's documented instructions regarding Atlassian's Processing of Customer Data ("Documented Instructions").

·(b) Atlassian must Process Customer Data solely in accordance with the Documented Instructions, as further stated in Section 6.1 of Schedule 1 (Description of Processing). Customer:

·(i) must ensure its Documented Instructions comply with Applicable Data Protection Law. Atlassian is not responsible for monitoring Customer's compliance with Applicable Data Protection Law; and

·(ii) is responsible for determining whether the Products and related Support and Advisory Services are appropriate for the Processing of Customer Data under Applicable Data Protection Law.

2.22.2 Confidentiality. Atlassian must treat Customer Personal Data as Customer's Confidential Information under the Agreement. Atlassian must ensure personnel authorized to Process Personal Data are bound by written or statutory obligations of confidentiality.

33. Security

3.13.1 Security Measures. Atlassian has implemented and will maintain appropriate technical and organizational measures designed to protect the security, confidentiality, integrity and availability of Customer Data and protect against Security Incidents. Customer is responsible for configuring the Products and using features and functionalities made available by Atlassian to maintain appropriate security in light of the nature of Customer Data. Atlassian's current technical and organizational measures are described here. Customer acknowledges that the Security Measures are subject to technical progress and development and that Atlassian may update or modify the Security Measures from time to time, provided that such updates and modifications do not materially decrease the overall security of the Cloud Products during a Subscription Term.

3.23.2 Security Incidents. Atlassian must notify Customer without undue delay and, where feasible, no later than seventy-two (72) hours after becoming aware of a Security Incident. Atlassian must make reasonable efforts to identify the cause of the Security Incident, mitigate the effects and remediate the cause to the extent within Atlassian's reasonable control. Upon Customer's request and taking into account the nature of the Processing and the information available to Atlassian, Atlassian must assist Customer by providing information reasonably necessary for Customer to meet its Security Incident notification obligations under Applicable Data Protection Law. Atlassian's notification of a Security Incident is not an acknowledgment by Atlassian of its fault or liability.

44. Sub-processing

4.14.1 General Authorisation. By entering into this DPA, Customer provides general authorisation for Atlassian to engage Sub-processors to Process Customer Personal Data. Atlassian must: (i) enter into a written agreement with each Sub-processor imposing data protection terms that require the Sub-processor to protect Customer Personal Data to the standard required by Applicable Data Protection Law and to the same standard provided by this DPA; and (ii) remain liable to Customer if such Sub-processor fails to fulfill its data protection obligations with regard to the relevant Processing activities under the Agreement.

4.24.2 Notice of New Sub-processors. Atlassian maintains an up-to-date list of its Sub-processors here, which contains a mechanism for Customer to subscribe to notifications of new Sub-processors. Atlassian will provide such notice, to those emails subscribed, at least thirty (30) days before allowing any new Sub-processor to Process Customer Personal Data (the "Sub-processor Notice Period").

4.34.3 Objection to New Sub-processors. Customer may object to Atlassian's appointment of a new Sub-processor during the Sub-processor Notice Period. If Customer objects, Customer, as its sole and exclusive remedy, may terminate the applicable Order for the affected Cloud Product and related Support and Advisory Services in accordance with Section 12.2 (Termination for Convenience) of the Agreement.

55. Assistance and Cooperation Obligations

5.15.1 Data Subject Rights. Taking into account the nature of the Processing, Atlassian must provide reasonable and timely assistance to Customer to enable Customer to respond to requests for exercising a data subject's rights (including rights of access, rectification, erasure, restriction, objection, and data portability) in respect to Customer Personal Data.

5.25.2 Cooperation Obligations. Upon Customer's reasonable request, and taking into account the nature of the Processing, Atlassian will provide reasonable assistance to Customer in fulfilling Customer's obligations under Applicable Data Protection Law (including data protection impact assessments and consultations with regulatory authorities), provided that Customer cannot reasonably fulfill such obligations independently with help of available Documentation.

5.35.3 Third Party Requests. Unless prohibited by Law, Atlassian will promptly notify Customer of any valid, enforceable legal process or governmental request compelling Atlassian to disclose Customer Personal Data. Atlassian will follow its law enforcement guidelines in responding to such requests. In the event that Atlassian receives an inquiry or a request for information from any other third party (such as a regulator or data subject) concerning the Processing of Customer Personal Data, Atlassian will redirect such inquiries to Customer, and will not provide any information unless required to do so under Law.

66. Deletion and Return of Customer Personal Data

6.16.1 During Subscription Term. During the Subscription Term, Customer and its Users may, through the features of the Cloud Products, access, retrieve or delete Customer Personal Data.

6.26.2 Post Termination. Following expiration or termination of the Agreement, Atlassian must, in accordance with the Documentation, delete all Customer Personal Data. Notwithstanding the foregoing, Atlassian may retain Customer Personal Data (i) as required by Applicable Data Protection Law or (ii) in accordance with its standard backup or record retention policies, provided that, in either case, Atlassian will maintain the confidentiality of, and otherwise comply with the applicable provisions of this DPA with respect to, retained Customer Personal Data and not further Process it except as required by Applicable Data Protection Law.

77. Audit

7.17.1 Audit Reports. Atlassian is regularly audited by independent third-party auditors and/or internal auditors, including as described here. Upon request, and on the condition that Customer has entered into an applicable non-disclosure agreement with Atlassian, Atlassian will supply a summary copy of relevant audit report(s) to Customer, so Customer can verify Atlassian's compliance with the audit standards against which it has been assessed, and this DPA. If Customer cannot reasonably verify Atlassian's compliance with the terms of this DPA, Atlassian will provide written responses (on a confidential basis) to all reasonable requests for information made by Customer related to Atlassian's Processing of Customer Personal Data, provided that such right may be exercised no more than once every twelve (12) months.

7.27.2 On-site Audits. Only to the extent Customer cannot reasonably satisfy Atlassian's compliance with this DPA through the exercise of its rights under Section 7.1 above, or where required by Applicable Data Protection Law or a regulatory authority, Customer, or its authorized representatives, may, at Customer's expense, conduct audits (including inspections) during the term of the Agreement to assess Atlassian's compliance with the terms of this DPA. Any audit must (i) be conducted during Atlassian's regular business hours, with reasonable advance written notice of at least sixty (60) calendar days (unless Applicable Data Protection Law or a regulatory authority requires a shorter notice period); (ii) be subject to reasonable confidentiality controls obligating Customer (and its authorized representatives) to keep confidential any information disclosed that, by its nature, should be confidential; (iii) occur no more than once every twelve (12) months; and (iv) restrict its findings to only information relevant to Customer.

88. International Provisions

·To the extent Atlassian Processes Personal Data protected by Applicable Data Protection Laws in one of the regions listed in Schedule 2 (Region-Specific Terms), the terms specified for the applicable regions will also apply, including the provisions relevant for international transfers of Personal Data (directly or via onward transfer).

99. Authorised Affiliates

9.19.1 Authorised Affiliate Rights. Only the Customer that has entered the Agreement may exercise any right or seek any remedy under this DPA, and such Customer must exercise such rights and seek such remedies in a combined manner, for itself and all Authorised Affiliates, instead of doing so separately for each.

9.29.2 Communication Obligations. The Customer that has entered the Agreement is responsible for coordinating all communication with Atlassian under this DPA and making and receiving any communications related to this DPA on behalf of its Authorised Affiliates.

9.39.3 Liability. For clarity, each party's and its Affiliates' liability arising out of or related to this DPA is subject to the "Limitations of Liability" section in the Agreement and any reference in such section to the liability of a party means aggregate liability of that party and all of its Affiliates under the Agreement (including this DPA).

1010. Definitions

·"Applicable Data Protection Law" means all Laws applicable to the Processing of Personal Data under the Agreement.

·"Authorised Affiliate" means any Customer Affiliate which: (i) is subject to Applicable Data Protection Law with respect to the Customer Personal Data; and (ii) may use the Products and related Support and Advisory Services under the Agreement, but has not signed its own Order with Atlassian, and is not a "Customer" as defined under the Agreement.

·"Controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.

·"Customer Personal Data'' means Personal Data contained in Customer Data and/or Customer Materials that Atlassian Processes under the Agreement solely on behalf of Customer. For clarity, Customer Personal Data includes any Personal Data included in the attachments provided by Customer or its Users in any technical support requests.

·"Personal Data" means information about an identified or identifiable natural person, or which otherwise constitutes "personal data", "personal information", "personally identifiable information" or similar terms as defined in Applicable Data Protection Law.

·"Processing" (and "Process" and "Processed") means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

·"Processor" means the entity which Processes Personal Data on behalf of the Controller.

·"Security Incident'' means any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data Processed by Atlassian and/or its Sub-processors, and for the purposes of this definition, "Processing" includes Personal Data and Customer Data.

·"Sub-processor" means any third party (inc. Atlassian Affiliates) engaged by Atlassian to Process Customer Personal Data.

Schedule 1Schedule 1 Description of Processing

11. Categories of data subjects whose Personal Data is Processed: Customer, Users, and any other individuals whose Personal Data is provided to Atlassian by or at the direction of Customer or its Users via the Cloud Products, including from Third-Party Products..

22. Categories of Personal Data Processed: Customer Personal Data, the content of which is determined and controlled solely by Customer and its Users.

33. Sensitive data transferred: Subject to Section 6.3 of the Agreement (Sensitive Health Information and HIPAA), Customer or its Users may upload content to the Cloud Products which may include (i) data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, (ii) genetic data, biometric data Processed for the purposes of uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation, or (iii) data relating to criminal convictions and offences (collectively "Sensitive Data"), which is determined and controlled solely by Customer and its Users.

44. The frequency of the transfer: Continuous.

55. Nature of the Processing: Atlassian will Process Personal Data in order to provide the Products and related Support and Advisory Services in accordance with the Agreement, including this DPA. Additional information regarding the nature of the Processing (including transfer) is described in respective Orders for relevant Products and Documentation referring to technical capabilities and features, including but not limited to collection, structuring, storage, transmission, or otherwise making available of Personal Data by automated means.

66. Purposes of the Processing:

6.16.1. Customer Data: Atlassian will Process Customer Data as a Processor in accordance with Customer's Documented Instructions to:

·(a) provide and improve the Products and related Support and Advisory Services for Customer only, and enable the use of various features and functionalities in accordance with the Documentation and as directed by Users through the Cloud Products, including investigating Security Incidents, and resolving issues, bugs and errors; and

·(b) enforce the Acceptable Use Policy.

6.26.2. De-identified and Aggregated Data. In accordance with applicable data contribution Cloud Product functionalities, Atlassian must de-identify and aggregate Customer Data and may use such De-identified and Aggregated Data to improve the Cloud Products and related Support and Advisory Services generally. "De-identified and Aggregated Data" means Customer Data that cannot reasonably be used to single out, infer information about, or otherwise be linked to an individual data subject.

6.36.3. Controller Activities. Atlassian is a Controller of Personal Data as specified in Atlassian's Privacy Policy. This DPA does not limit or prohibit Atlassian from acting in that capacity.

77. Duration of Processing: Atlassian will Process Customer Personal Data for the term of the Agreement as outlined in Section 6 (Deletion and Return of Customer Personal Data).

88. Transfers to Sub-processors: Atlassian will transfer Customer Personal Data to Sub-processors as permitted in Section 4 (Sub-processing).

Schedule 2Schedule 2 Region-Specific Terms

·Unless otherwise defined in this DPA or in the Agreement, all capitalized terms used in this Schedule will have the meanings given to them in Section 4 of this Schedule.

11. Europe, United Kingdom and Switzerland

1.11.1 Customer Instructions. In addition to Section 2.1 (Customer Instructions), and Schedule 1 (Description of Processing) of the DPA above, Atlassian will Process Customer Personal Data only on Documented Instructions from Customer, including with regard to transfers of such Customer Personal Data to a third country or an international organisation, unless required to do so by Applicable Data Protection Law to which Atlassian is subject; in such a case, Atlassian shall inform Customer of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest. Atlassian will promptly inform Customer if it becomes aware that Customer's Processing instructions infringe Applicable Data Protection Law.

1.21.2 European Transfers. Where Personal Data protected by the EU Data Protection Law is transferred, either directly or via onward transfer, to a country outside of Europe that is not subject to an adequacy decision, the following applies:

·(a) The EU SCCs are hereby incorporated into this DPA by reference as follows:

·(i) Customer is the "data exporter" and Atlassian is the "data importer." (ii) Module Two (Controller to Processor) applies where Customer is a Controller of Customer Personal Data and Atlassian is Processing Customer Personal Data as a Processor. (iii) Module Three (Processor to Processor) applies where Customer is a Processor of Customer Personal Data and Atlassian is Processing Customer Personal Data as another Processor. (iv) By entering into this DPA, each party is deemed to have signed the EU SCCs as of the commencement date of the Agreement.

·(b) For each Module, where applicable:

·(i) In Clause 7, the optional docking clause does not apply. (ii) In Clause 9, Option 2 applies, and the time period for prior notice of Sub-processor changes is stated in Section 4 (Sub-processing) of this DPA. (iii) In Clause 11, the optional language does not apply. (iv) In Clause 17, Option 1 applies, and the EU SCCs are governed by Irish law. (v) In Clause 18(b), disputes will be resolved before the courts of Ireland. (vi) The Appendix of EU SCCs is populated as follows:

• ·The information required for Annex I(A) is located in the Agreement and/or relevant Orders.
• ·The information required for Annex I(B) is located in Schedule 1 (Description of Processing) of this DPA.
• ·The competent supervisory authority in Annex I(C) will be determined in accordance with the Applicable Data Protection Law; and
• ·The information required for Annex II is located here.

1.31.3 Swiss Transfers. Where Personal Data protected by Swiss Data Protection Law is transferred, either directly or via onward transfer, to any other country that is not subject to an adequacy decision, the EU SCCs apply as stated in in Section 1.2 (European Transfers) above with the following modifications:

·(a) All references in the EU SCCs to "Regulation (EU) 2016/679" will be interpreted as references to Swiss Data Protection Law, and references to specific Articles of "Regulation (EU) 2016/679" will be replaced with the equivalent article or section of Swiss Data Protection Law; all references to the EU Data Protection Law in this DPA will be interpreted as references to Swiss Data Protection Law.

·(b) In Clause 13, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner.

·(c) In Clause 17, the EU SCCs are governed by the laws of Switzerland.

·(d) In Clause 18(b), disputes will be resolved before the courts of Switzerland.

·(e) All references to Member State will be interpreted to include Switzerland and Data Subjects in Switzerland are not excluded from enforcing their rights in their place of habitual residence in accordance with Clause 18(c).

1.41.4 United Kingdom Transfers. Where Personal Data protected by the UK Data Protection Law is transferred, either directly or via onward transfer, to a country outside of the United Kingdom that is not subject to an adequacy decision, the following applies:

·(a) The EU SCCs apply as set forth in Section 1.2 (European Transfers) above with the following modifications:

·(i) Each party shall be deemed to have signed the UK Addendum. (ii) For Table 1 of the UK Addendum, the parties' key contact information is located in the Agreement and/or relevant Orders. (iii) For Table 2 of the UK Addendum, the relevant information about the version of the EU SCCs, modules, and selected clauses which this UK Addendum is appended to is located above in Section 1.2 (European Transfers) of this Schedule. (iv) For Table 3 of the UK Addendum:

• ·The information required for Annex 1A is located in the Agreement and/or relevant Orders.
• ·The Information required for Annex 1B is located in Schedule 1 (Description of Processing) of this DPA.
• ·The information required for Annex II is located here.
• ·The information required for Annex III is located in Section 4 (Sub-processing) of this DPA.

·(b) In Table 4 of the UK Addendum, both the data importer and data exporter may end the UK Addendum.

1.51.5 Data Privacy Framework. Atlassian participates in and certifies compliance with the Data Privacy Framework. As required by the Data Privacy Framework, Atlassian (i) provides at least the same level of privacy protection as is required by the Data Privacy Framework Principles; (ii) will notify Customer if Atlassian makes a determination it can no longer meet its obligation to provide the same level of protection as is required by the Data Privacy Framework Principles, and (iii) will, upon written notice, take reasonable and appropriate steps to remediate any unauthorized Processing of Personal Data.

22. United States of America

·The following terms apply where Atlassian Processes Personal Data subject to the US State Privacy Laws:

2.12.1. To the extent Customer Personal Data includes personal information protected under US State Privacy Laws that Atlassian Processes as a Service Provider or Processor, on behalf of Customer, Atlassian will Process such Customer Personal Data in accordance with the US State Privacy Laws, including by complying with applicable sections of the US State Privacy Laws and providing the same level of privacy protection as required by US State Privacy Laws, and in accordance with Customer's Documented Instructions, as necessary for the limited and specified purposes identified in Section 6.1 of Schedule 1 (Description of Processing) of this DPA. Atlassian will not:

·(a) retain, use, disclose or otherwise Process such Customer Personal Data for a commercial purpose other than for the limited and specified purposes identified in this DPA, the Agreement, and/or any related Order, or as otherwise permitted under US State Privacy Laws;

·(b) "sell" or "share" such Customer Personal Data within the meaning of the US State Privacy Laws; and

·(c) retain, use, disclose or otherwise Process such Customer Personal Data outside the direct business relationship with Customer and not combine such Customer Personal Data with personal information that it receives from other sources, except as permitted under US State Privacy Laws.

2.22.2. Atlassian must inform Customer if it determines that it can no longer meet its obligations under US State Privacy Laws.

2.32.3. Customer may take reasonable and appropriate steps to stop and remediate any unauthorized Processing of Customer Personal Data.

2.42.4. To the extent Customer discloses or otherwise makes available De-identified Data to Atlassian or to the extent Atlassian creates De-identified Data from Customer Personal Data, in each case in its capacity as a Service Provider, Atlassian will:

·(a) adopt reasonable measures to prevent such De-identified Data from being used to infer information about, or otherwise being linked to, a particular natural person or household;

·(b) publicly commit to maintain and use such De-identified Data in a de-identified form and to not attempt to re-identify the De-identified Data, except that Atlassian may attempt to re-identify such data solely for the purpose of determining whether its de-identification processes are compliant with the US State Privacy Laws; and

·(c) before sharing De-identified Data with any other party, including Sub-processors, contractors, or any other persons ("Recipients"), contractually obligate any such Recipients to comply with all requirements of this Section 2.4 (including imposing this requirement on any further Recipients).

33. South Korea

3.13.1. Customer agrees that it has provided notice and obtained all consents and rights necessary under South Korea Privacy Law for Atlassian to Process Personal Data pursuant to the Agreement.

3.23.2. To the extent Customer discloses or otherwise makes available De-identified Data to Atlassian, Atlassian will:

·(a) maintain and use such De-identified Data in a de-identified form and not attempt to re-identify the De-identified Data; and

·(b) before sharing De-identified Data with any other party, including Sub-processors, contractors, or any other persons ("Recipients"), contractually obligate any such Recipients to comply with all requirements of this Section 3.2 (including imposing this requirement on any further Recipients).

44. Brazil

4.14.1. Where Personal Data protected by the Brazilian Data Protection Law is transferred, either directly or via onward transfer, to a country that does not provide an adequate level of protection within the meaning of the Brazilian Data Protection Law, the following applies:

·(a) the Brazilian Transfer Clauses are hereby incorporated into this DPA by reference as follows:

·(i) Each party shall be deemed to have signed the Brazilian Transfer Clauses.

·(ii) Customer is the "exporter" and Atlassian is the "importer", as appropriate, for purposes of Clause 1 of the Brazilian Transfer Clauses.

·(iii) The contents of Schedule 1 (Description of Processing) of the DPA above shall form Clause 2 of the Brazilian Transfer Clauses.

·(iv) Option B for Clause 3 of the Brazilian Transfer Clauses shall apply, and the parties agree that any onward transfer of Personal Data subject to the Brazilian Data Protection Law by Atlassian will be carried out pursuant to a valid mechanism for data transfers provided for in the Brazilian Data Protection Law, such as the Brazilian Transfer Clauses.

·(v) With respect to Clause 4 of the Brazilian Transfer Clauses: (1) the parties select Option A for transfers where Customer is a Controller, and the parties agree that, except as otherwise provided for under the DPA above, the Agreement, and/or any related Order, Customer is responsible for the compliance obligations addressed in Clauses 4.1(a)-(c); and (2) the parties select Option B for transfers where both Customer and Atlassian are a Processor, and the relevant third-party Controller is as identified by the Customer.

·(vi) The information required for Section III of the Brazilian Transfer Clauses is located here.

55. Definitions

·"Brazilian Data Protection Law" means the General Data Protection Law, Brazilian Law 13.709/2018.

·"Brazilian Transfer Clauses" means the standard contractual clauses approved by the Resolution CD/ANPD No. 19, August 23, 2024.

·"De-identified Data" means data that cannot reasonably be used to infer information about, or otherwise be linked to, any individual data subject.

·"Data Privacy Framework" means the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework self-certification program operated by the US Department of Commerce.

·"Europe" includes, for the purposes of this DPA, the Member States of the European Union and European Economic Area.

·"EU Data Protection Law" includes (i) the Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation, or GDPR) and (ii) the EU e-Privacy Directive (Directive 2002/58/EC) as amended, superseded or replaced from time to time.

·"EU SCCs" means the contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, as amended, superseded, or replaced from time to time.

·"Service Provider" has the same meaning as given in the CCPA.

·"South Korea Privacy Law" means the South Korean Personal Information Protection Act and its Enforcement Decrees.

·"Swiss Data Protection Law" means the Swiss Federal Act on Data Protection and its implementing regulations as amended, superseded, or replaced from time to time.

·"UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, Version B1.0, in force 21 March 2022, as amended, superseded or replaced from time to time.

·"UK Data Protection Law" means the Data Protection Act 2018 and the GDPR as saved into United Kingdom law by virtue of Section 3 of the United Kingdom's European Union (Withdrawal) Act 2018 as amended, superseded or replaced from time to time.

·"US State Privacy Laws" means all applicable state laws relating to the protection and Processing of Personal Data in effect in the United States of America, which may include, without limitation, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its implementing regulations ("CCPA").

·Frequently Asked Questions

·We created this FAQ to answer some of the most common questions customers ask about our DPA.

·Legal Notice: These FAQs are for informational purposes only and do not create any contractual commitments. The responsibilities and liabilities of Atlassian towards its customers are governed by Atlassian agreements, and these FAQs are not part of, nor do they modify, any agreement between Atlassian and its customers.

·How does the Atlassian DPA apply and what does it apply to? Copy link to heading Copied! show

·Why can't Atlassian use my organization's DPA? Copy link to heading Copied! show

·What if my organization prefers to have signed EU SCCs? Copy link to heading Copied! show

·What is the scope of the DPA? Copy link to heading Copied! show

·How does Atlassian help organizations respond to data subject requests? Copy link to heading Copied! show

·What is a sub-processor and does Atlassian use sub-processors? Copy link to heading Copied! show

·Who are Atlassian's sub-processors? Copy link to heading Copied! show

·What are Atlassian's security measures and where can I find them? Copy link to heading Copied! show

·What transfer mechanisms does Atlassian use when transferring data from the EU/UK/Switzerland? Copy link to heading Copied! show

·Where can I find more information about Atlassian's privacy program? Copy link to heading Copied! show

·Subscribe to receive an email whenever we make changes

·You're logged in as: Update contact info > * Required fields

·Related content

·Atlassian Customer Agreement

·Learn more

·Product-specific terms

·Learn more

·Data Transfer Impact Assessment

·Learn more

·Business Associate Agreement

·Learn more

·Stay informed

·Subscribe to receive notifications from us about updates to our legal terms (including our legal policies) and our list of sub-processors. Sign up for updates