Marketplace App Trust
Trust is a key component of the relationship between Atlassian customers and our third-party Marketplace Partners.
Cloud apps are a shared responsibility
Atlassian provides information, controls and capabilities, while facilitating communication between you and Marketplace Partners.
Marketplace Partners
Marketplace partners design apps and operational processes according to their legal obligations, Atlassian’s requirements, and general industry best practices for reliable, compliant, and secure apps. They also provide support and information to help you make informed decisions.
Atlassian
Atlassian provides information and capabilities to help Marketplace Partners build trustworthy apps and to help customers vet and manage apps.
You
You leverage the information provided by Atlassian and Marketplace Partners to vet apps against your requirements. It’s important to acknowledge that app installation requires a new relationship with a Marketplace Partner that is separate from your relationship with Atlassian.
Atlassian's approach to supporting customers and partners
Data protection support for Marketplace Partners
Atlassian has programs, tools, educational resources, and requirements in place to help third parties protect your data when you extend your workflows with Marketplace apps. In the event that partners aren't meeting our requirements, we may take actions like removing badges, hiding apps from the Marketplace, pausing them, or adding them to a public transparency page.
Setting a privacy & security baseline
Our Marketplace programs help Marketplace Partners achieve the highest consistent standards for application security and privacy.
Setting a security baseline with requirements
Atlassian has defined a minimum set of cloud App Security requirements that all Marketplace apps must meet. These requirements, including security questionnaires for new and updated apps, are mandatory and aim to enforce continual improvement and security best practices across all apps.
Maintaining security through continuous scanning
Atlassian’s Ecoscanner platform performs security checks across all Marketplace cloud apps on an ongoing basis to help ensure the security of our ecosystem.
If an app is found to be missing a security requirement, Atlassian will take action to protect customers.
Timely resolution of security issues
To ensure the security of all Marketplace cloud apps, Marketplace Partners are required to adhere to security bug fix SLAs. If a vulnerability or missing security requirement is detected in any app listed on the Marketplace, partners are required to respond in a timely manner.
Enhanced vulnerability discovery via opt-in Bug Bounty program
Atlassian has a best-in-class Marketplace bug bounty program to increase security and trust. Participating Marketplace Partners are able to proactively combat security risks before they arise by incentivizing security researchers to find vulnerabilities. While the program is generally optional, apps must participate to get a Cloud Fortified badge.
Ensuring transparency through privacy requirements
Apps are required to provide a privacy policy that outlines data access, collection and processing, and with whom and where End User Data might be shared or stored.
In addition to a privacy policy, Atlassian requires partners to obtain all necessary rights, permissions, and consents from end users for any processing of any End User Data.
Find apps that are going the extra mile to protect your data and workflows
On the Atlassian Marketplace, you may notice that some apps have a Cloud Fortified or Runs on Atlassian badge. These badges help you easily identify apps that have gone above and beyond Atlassian's general standards to deliver a secure and reliable cloud experience.
The requirements for each badge are as follows:
| | All Cloud apps | Cloud Fortified apps | Runs on Atlassian | |
|---|---|---|---|---|
Base cloud app security requirements | ||||
Monitored by Atlassian’s app vulnerability scanning platform, Ecoscanner | ||||
Additional app security requirements and fix timeframes defined by Atlassian | ||||
Participates in Marketplace Bug Bounty Program | ||||
Has a complete Privacy & Security tab | ||||
Hosted on Atlassian | ||||
Data stored within Atlassian | ||||
Data residency compliant | ||||
Additional checks for service reliability and performance at scale | ||||
Incident and review processes integrated with Atlassian's for faster recovery and continuous improvement | ||||
Commercially reasonable efforts to provide support | ||||
24 hour response time, 5 days a week SLA for all T1 tickets |
Frequently Asked Questions
What does Atlassian do to ensure the security of Marketplace apps?
Can Marketplace apps access, process or store my data?
Are there controls to block Marketplace Partners from accessing or extracting customer data?
Does Atlassian perform application penetration testing to Marketplace apps?
Do I have to go through a security assessment for each Marketplace app I am using?
What is the “Runs on Atlassian” badge?
Trust & Security Community
Join the Trust & Security group on the Atlassian Community to receive information, tips, and best practices for using Atlassian products in a secure and reliable way.