Forums

Articles
Create
cancel
Showing results for 
Search instead for 
Did you mean: 

Atlassian sub-processors questions

Atlassian has published a list of sub-processors here: https://www.atlassian.com/legal/sub-processors .

However this list of sub-processors seems not complete.  When you use Conflucence, Jira, and other Atlassian sites, data gets transferred to (among others):

  • Google (Google fonts, Analytics, Ads)
  • Launchdarkly
  • Linkedin
  • Facebook
  • Clicktale
  • Vimeo
  • Optimizely
  • Marketo
  • Reddit
  • Doubleclick
  • Bing

Actually the site listing the sub-processors uses all of the above as of today (Monday, November 21, 2022).

4 comments

Nic Brough -Adaptavist-
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
November 21, 2022

I would point out that a lot of those are probably being called by apps, not the core Atlassian systems.

Dave Meyer
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
November 21, 2022

Our cloud infrastructure and architecture for our products is distinct from www.atlassian.com. The presence of references to these services on a www.atlassian.com page does not mean that they are present in Jira, Confluence, or our other products.

Additionally, the definition of a sub-processor in the GDPR specifically refers to access to data. The presence of a cookie or 3rd-party library does not imply that a vendor is a sub-processor.

marc -Collabello--Phase Locked-
Community Champion
November 22, 2022

@Nic Brough -Adaptavist- These services are on the atlassian.com domain, and are not caused by apps.

@Dave Meyer Atlassian.com is required for e.g. login, documentation and the marketplace.  So in effect I would say it is "part of" the Jira and Confluence offer.

Once you install cookies or 3rd party libraries on a website, the vendors (or providers) are sub-processors in terms of GDPR.  See for example the explanation at https://www.simpleanalytics.com/blog/denmark-declares-google-analytics-unlawful which references the original letter of the Danish DPA.

Like Steffen Opel _Utoolity_ likes this
marc -Collabello--Phase Locked-
Community Champion
February 3, 2023

@Dave Meyer , @Nic Brough -Adaptavist- ,

I have found a link where Atlassian says it is using specific external services: https://support.atlassian.com/organization-administration/docs/ip-addresses-and-domains-for-atlassian-cloud-products/

Among these are:

  • Pubnub
  • Wordpress/Gravatar Content Delivery Network
  • Google Hosted Libraries Content Delivery Network
  • Optimizely Digital Experience delivery
  • LaunchDarkly Digital Experience delivery
  • Twilio Segment
  • Sentry.io Content Delivery Network

 

These external services must be declared as subprocessors, if Atlassian uses them in their applications.

Comment

Log in or Sign up to comment
TAGS
AUG Leaders

Atlassian Community Events