Marketplace App Trust

Atlassian has programs and requirements in place to ensure a baseline of security and privacy across 3rd party Marketplace apps, as well as opt-in programs to encourage additional investment. We also regularly share educational materials to help Marketplace Partners build trustworthy cloud apps.

To maintain the baseline of security and privacy best practices across all 3rd party cloud apps, Atlassian regularly scans all cloud apps listed on the Marketplace. Specific Cloud Security Requirements are enforced via a set of security scanners powered by Atlassian’s EcoScanner platform.

Marketplace Partners must also complete a set of security questionnaires as part of the existing App Onboarding and App Review Processes. This ensures continual assurance that apps meet or exceed the bar Atlassian has set for app security and that Marketplace Partners adhere to organizational best practices.

In addition, all Marketplace Partners must undergo a Personal and Business Identification (KYC/KYB) process. They must also accept and comply with Atlassian Developer Terms, Marketplace Partner Agreement, and Security Bug Fix Policy for Marketplace apps, which outline legal and privacy requirements and SLAs for security bugs.

Alongside our baseline security requirements, we also issue badges for the Marketplace to apps that have made additional investments in security, reliability, and support. These badges identify:

• Cloud Fortified Apps
• Runs on Atlassian

For trust-related information (data protection, security, privacy, compliance) about specific apps, you can also view the answers provided by the app’s vendor in the Privacy & Security tab of their app listing on the Atlassian Marketplace.

Most apps require access to data in your instance to perform their core functions. Admins must review and consent to requested permissions during the installation flow.

Where and how data is handled depends on the app's architecture and certifications:

• Runs on Atlassian (RoA): Apps with this badge process and store customer data exclusively on Atlassian cloud infrastructure, while giving administrators visibility and control over any external data egress (such as analytics).
• Atlassian Enterprise Certified (AEC): If an AEC app processes or stores data off-Atlassian, its hosting environments and data handling controls have been rigorously verified against AEC requirements.
• Privacy & Security Tab: Check any app listing for granular details on permissions, data processing, storage, and retention.

With the app access rule under data security policies, customers can limit app access to certain content in selected projects or spaces. You can create an app access rule to limit an app’s ability to access and modify certain data in a Confluence space or Jira project, particularly user-generated content such as pages, blog posts, attachments, and other content that a user adds to a Confluence space or Jira project. This feature enables org admins to block all apps from spaces and projects, whereas Atlassian Access customers can make a selection and block a subset of installed apps. Learn more about blocking app access.

Atlassian is building more data loss prevention capabilities, such as data classification, to our Cloud offerings. Atlassian Guard is an easy way to defend your data and improve security posture. You can stay up-to-date on the development of these features by following our Cloud roadmap.

Additionally, there are vendors in the Atlassian Marketplace who provide DLP solutions that may meet your needs.

Yes. Marketplace partners are independent businesses, and installing an app establishes a direct relationship with that partner.

Atlassian sets strict baselines to protect our customers. All Marketplace partners must comply with our security requirements for cloud apps, though Atlassian is not directly responsible for third-party products or services. Customers are responsible for reviewing third-party apps, agreements, and privacy policies against their internal standards.

To simplify your evaluation, every cloud app listing includes a Privacy & Security tab detailing security practices, permissions, and compliance certifications.

You can also explore our trust programs to identify apps meeting higher enterprise standards:

• Runs on Atlassian (RoA): Indicates apps built exclusively on Atlassian-hosted infrastructure (About Forge), while giving administrators visibility and control over any external data egress (such as analytics).
• Atlassian Enterprise Certified (AEC): Highlights apps vetted against comprehensive enterprise security, reliability, and support requirements—including independent verification of external data handling for apps hosting data off-Atlassian.

If you have additional questions about a specific tool, we recommend contacting the partner directly via the security contact on their listing to ensure it meets your organization’s requirements.

Atlassian provides programs, developer tools, educational resources, and compliance frameworks to ensure third-party Marketplace apps protect your data.

Key safeguards include:

• Strict security standards: Mandatory Security requirements for cloud apps
• Trust programs: Runs on Atlassian and Atlassian Enterprise Certified badges, helping you easily identify apps meeting higher reliability and security standards.
• Secure infrastructure: Forge, offering built-in security controls and data isolation.
• Compliance capabilities: APIs and services to help partners support data residency requirements: Understand data residency | Atlassian Support

If a partner fails to meet these standards, Atlassian enforces accountability by removing badges, pausing or hiding app listings, or listing non-compliant apps on a public transparency page.

Administrators have centralized visibility and granular control through admin.atlassian.com, including:

• Centralized monitoring: Manage, review, and track all installed apps across your organization from a single console.
• Installation guardrails: Restrict end-user app installs and establish approval workflows before apps are added to your workspace.
• Granular access controls: Limit app data access to specific spaces, projects, or selected content.
• Audit & activity tracking: ReviewView audit log activities | Atlassian Supportto audit actions, changes, and access events.
• Listing transparency: Access mandatory partner privacy policies and detailed security disclosures directly on the Marketplace.

We recommend a 5-step evaluation process:

1. Check the Privacy & Security tab: Review permissions, certifications, and data handling practices.
2. Read the partner’s privacy policy: Confirm data retention and usage terms.
3. Visit the partner trust center (if available): Review external audits, certifications, and security whitepapers.
4. Reach out directly: Use the dedicated security contact listed on the Marketplace page for specific compliance inquiries.
5. Track version updates: Use the Connected Apps tab in admin.atlassian.com to monitor ongoing changes and updates.