Confiança dos aplicativos do Marketplace

Atlassian has programs and requirements in place to ensure a baseline of security and privacy across 3rd party Marketplace apps, as well as opt-in programs to encourage additional investment. We also regularly share educational materials to help Marketplace Partners build trustworthy cloud apps.

To maintain the baseline of security and privacy best practices across all 3rd party cloud apps, Atlassian regularly scans all cloud apps listed on the Marketplace. Specific Cloud Security Requirements are enforced via a set of security scanners powered by Atlassian’s EcoScanner platform.

In addition, all Marketpalce Partners must accept and comply with Atlassian Developer Terms, Marketplace Partner Agreement and Security Bug Fix Policy for Marketplace apps, which outline legal and privacy requirements as well as SLAs for security bugs.

Alongside our baseline security requirements, we also issues badges for the Marketplace to apps that have made additional investments in security, reliability and support. These badges identify:

• Cloud Security Participant
• Cloud Fortified Apps

For trust-related information (data protection, security, privacy, compliance) about specific apps, you can also view the answers provided by the app’s vendor in the Privacy & Security tab of their app listing on the Atlassian Marketplace.

Most apps need to access data in your instance to perform their core functions.

Before you install an app, we will present a page requesting consent preferences, so that you may elect how data will be accessed, processed, and stored. Admins must consent to the app's request for data access during the installation flow.

Each Marketplace app requires a different set of permissions. These details, along with data handling practices (e.g data residency, processing, storage, retention), can be found in the Privacy & Security tab on the app listing in the Marketplace.

With the app access rule under data security policies, customers can limit app access to certain content in selected projects or spaces. You can create an app access rule to limit an app’s ability to access and modify certain data in a Confluence space or Jira project, particularly user-generated content such as pages, blog posts, attachments, and other content that a user adds to a Confluence space or Jira project. This feature enables org admins to block all apps from spaces and projects, whereas Atlassian Access customers can make a selection and block a subset of installed apps. Learn more about blocking app access.

Atlassian is building more data loss prevention capabilities, such as data classification, to our Cloud offerings. Atlassian Guard is an easy way to defend your data and improve security posture. You can stay up-to-date on the development of these features by following our Cloud roadmap.

Additionally, there are vendors in the Atlassian Marketplace who provide DLP solutions that may meet your needs.

No, Atlassian doesn’t perform penetration testing on Marketplace apps.

However, Atlassian has a Marketplace Security Bug Bounty program designed for apps which is a requirement of Cloud Fortified program or to get a Cloud Security Participant badge.

All Marketplace apps need to meet the cloud security requirements which are checked and enforced via security scanners and bug fix SLAs. Learn more about security scanning.

Yes. Marketplace partners are independent businesses and by installing an app, you are establishing a separate relationship with them.

Atlassian takes some measures to ensure apps listed on Marketplace meet certain standards. See the cloud security requirements for more details on the security standards we require all Marketplace partners to follow, but ultimately Atlassian is not responsible for the products or services offered by Marketplace partners.

It is your responsibility to review apps and agreements provided by third parties.

To make this process easier for you, every cloud app on Marketplace has a “Privacy & Security” section where partners share more details on app security, data protection, privacy and compliance.

You can also have a look at Marketplace Trust programs to see how we showcase apps that have made additional investments in security through Atlassian’s Cloud Security Participant and Cloud Fortified programs. In case of any remaining questions you may contact the individual app vendor.

Ultimately, it is up to you to vet each app before installation and decide whether it meets your requirements.