Marketplace 
サポート 
セキュリティ Vendor Security & Risk Responses
Here at Atlassian, we seek to be transparent in how we operate, secure and manage our cloud services. We understand that many of you have a Vendor Risk Management process for cloud services. We believe that we deliver really great cloud service and we love to talk about it!!
We have implemented a structured controls framework to manage the operations, security and reliability of our cloud services. Many of these controls are externally validated, and some of the controls are internal only.
If your Vendor Risk Management process is based on any of the below standardized questionnaires, you can download our pre-completed questionnaire. If your Vendor Risk Management process is based on relying on external certification, see the next section about our Compliance certifications.
If the options below do not answer the questions you have, feel free to contact our Atlassian Support team.
A comment on the value of compliance
Atlassian has compiled the below questionnaire responses to answer the common questions and formats that we receive from customers. However, it is worth saying that each of the below questionniares are self-attestation style responses. No independent third party has tested or validated these responses, and they should not be considered contractual and may be subject to change.
All of our independently validated, external attestations and certificates can be found on our Atlassian Compliance page. We firmly believe these certifications can and should serve as your primary assurance that we are operating, securing and managing our cloud-services with the interests of our customers in mind.
If you have any questions about our Compliance certificates, please ask us!!
Shared Assessments - SIG Questionnaire
The most common and longest standaing standardized information gathering tool, the SIG (Standardized Information Gathering) questionnaire, has been completed for our main Atlassian Cloud offerings. Originally developed for the Financial Services Industries, the assessment questionnaire can provide information on general controls that a cloud service provider has in place.
Cloud Security Alliance (CSA) - Consensus Assessment Initiative Questionnaire (CAIQ)
The Cloud Security Alliance was formed in 2009 as a research organization to determine the best practices for secure cloud computing. Over time, the CSA has issued a number of papers and practices on how to secure your cloud, your cloud service, and how evaluate a cloud service provider.
The CSA Cloud Controls Matrix (CCM) was developed, as well as the CSA Consensus Assessment Initiative Questionnaire (CAIQ), along with the STAR registry to house the completed questionnaires from cloud service providers.
The CSA is among the best known cloud service frameworks and standards. The Atlassian CAIQ entries can also be found on the Atlassian STAR registry.
Google Vendor Security Assessment Questionnaire (VSAQ)
Google has released an open source vendor security assessment questionnaire (VSAQ) tool. The tool is an interactive set of questions and web front end to answer and submit completed responses to customers.
Download the VSAQ Physical & Data Center Security Responses
(sha256 - 9540ef632b845e7677902b4f2ef72eb70ff025b53a9d1f9f807d0dbe7fa7909c)
Download the VSAQ Infrastructure Security Responses
(sha256 - 688142a6670ebdfa69a6ad820ef9f5f7252c2ff14dda2e93abddd9412636a403)
Download the VSAQ Security and Privacy Programs Responses
(sha256 - bf91dbb60f6ecc6f5a301111b29d18a1c4e9c04f1ef1e33b5fa6226e8e317891)