Frequently asked questions

Does Atlassian adhere to Information security standards

ISO/IEC 27001 - Jira and Confluence cloud have achieved ISO/IEC 27001 Certification. You can read more about the structure of our Security Management Program and you can review the ISO/IEC 27001 Certificate on our Atlassian Compliance page.

ISO/IEC 27018 - We have also acheived ISO/IEC 27018 certification for protection of personally identifiable information (PII) or personal data (PD) in our cloud environments. Our ISO/IEC 27018 Certificate can also be found on our Atlassian Compliance page.

Cloud Security Alliance - We have completed our Cloud Control Matrix CAIQ Self Assessment for the CSA Security, Trust, & Assurance Registry. 

HIPAA / HITECH – For our Cloud products, we are not able to sign a Business Associate agreement and we recommend our Server products for companies that need to comply. We have more information on this in our Privacy Policy.

PCI – Atlassian uses tokens with PCI DSS certified credit card processors; we never see or store your credit card details. For use of our products within PCI environments you need to assess in terms of your own PCI compliance requirements.

 

Has Atlassian defined responsibilities for cloud security and cloud operations? 

We have published a whitepaper outlining the responsibilities that we manage, and the responsibilities that each of our customers should manage. We've written it with our customers in mind, and we've detailed the particular security topics that each customer should manage. Read through the whitepaper. 

 

Can I see your Cloud Security Alliance (CSA) Consensus Assessment Initiative Questionnaire (CAIQ)? 

Absolutely, we hope you do.  It can be found on our Security, Trust and Assurance Registry (STAR) entry page.  We plan on updating it quarterly, or when big changes occur in our environment. Have a read through: Atlassian's STAR entry. 

 

Will Atlassian share information on your internal controls?

We have put a great deal of work into something we call our Atlassian Control Framework (ACF), which combines the controls from external regulatory requirements and industry standards.  We utilize this framework to implement controls internally and use external companies to evaluate and validate the implementation and operation of our controls.  You can view the status of any of our certifications or reports on our Compliance page. 

 

Will Atlassian share your internal policies?

We have put a lot of work into building out an internal Policy Central inside our own Confluence. All of our policies have a similar format and structure, defined owners, and committed review cycles. You can read through the tl;dr for each of our internal Technology Domain policies. 

 

Who has access to our data?

For Atlassian Cloud Customers, we've outlined our approach in our Cloud Security Statement and our Privacy Policy.

 

Is our data encrypted?

Atlassian uses TLS to protect information while in transit across the Internet. We have implemented TLS1.2 and Perfect Forward Secrecy (PFS) to further support data protection.

 

Is TLS always used?

Yes, all Atlassian Cloud systems only use TLS, along with PFS, for communication. In line with Industry standards, we have removed support for SSL 3.

 

How are our passwords stored?

Passwords are cryptographically hashed within Atlassian Cloud, which enables user management.

 

Does Atlassian audit its cloud security?

We have an extensive security program that includes ongoing testing of our our hosted systems and products.  We also undertake third party independent assessments of our Cloud products. We have also setup a public bug bounty for all of our cloud products and our server products. 

 

Can we see the testing reports?

We have worked with our bug bounty partner to create a penetration test report that is publicly available.

 

Can we undertake our own security testing?

In line with our Terms of Use for our Cloud products, we currently do not allow customer-initiated testing. We are committed to being open and will publish statistics from our bug bounty program once it is public. 

 

I found a vulnerability in one of your products, how do I report it? 

If you discovered a vulnerability in one of our products, we appreciate if you let us know so we can get it fixed ASAP.  Have a read through our instructions for how to report it and you could get some Atlassian swag or be added to our Hall of Fame.  

 

Can you complete my security questionnaire?

We are committed to being open and transparent and sharing information. Part of this goal is to publish as much information as we can to enable you to be comfortable with your decision to use our products and services. We are not able to answer each individual questionnaire.

 

What is Atlassian's data privacy policy?

Please check out our latest Privacy Policy.

 

What responsibilities does Atlassian maintain during a security incident? 

Here at Atlassian, we try our best to ensure our customers don't experience an outage or a security incident. However, we acknowledge that a security incident has the potential to happen. We have written down our responsibilities during a security incident and what our customers should plan to manage.