New "Data Residency at Atlassian" one‑pager for your Security and Compliance

[#1]

Hey Atlassian Community! I’m Jo from Atlassian’s Trust Team. We work with security, privacy and product experts to help customers answer a simple question:

“Can we trust Atlassian with X?”

When it comes to data residency, we hear a common challenge: execs and procurement/risk stakeholders need something short and clear they can reuse — not a full whitepaper.

So we’ve published the first in a new series of Trust one‑pagers: a concise, exec‑ready overview you can drop into internal briefs, decks, or vendor reviews.

Trust Portal

New to the Trust Portal? You may be guided through a quick, one‑time access flow (one‑time code, and possibly an NDA for your organisation). To learn more about the Atlassian Customer Trust Portal, visit the post of @Alex Griswold , Head of Trust Engagement at Atlassian .

What it covers (in plain terms)

• What “data residency” means in Atlassian Cloud

• How selecting a region affects where product data is stored

• When/why some data may be processed outside the selected region

• High‑level safeguards (encryption, access controls, contractual protections)

• Links to deeper documentation when you need it

When it’s useful

You might find this handy for:

• Board / exec briefings

• Procurement & due‑diligence packs

• Internal risk assessments (security/privacy/legal)

• Pre‑reads before internal compliance discussions

Call to action (please comment!)

1. Download the one-pager? If you used it in a real review, tell us if it saved time.

2. Is the format helpful for exec audiences? Too high-level? Too detailed?

3. What should we publish next? If you want more one‑pagers, comment with 1–2 topics you’d like covered (and who the audience is: CISO, DPO, procurement, board, etc.).

A few topic ideas we’re considering:

• Rovo / AI security & privacy — executive overview

• Encryption & key management (incl. BYOK positioning)

• Sub‑processors and third‑party access to data

• Incident response transparency & timelines

• Vulnerability management & prioritization

We’ll use your feedback to prioritise Wave 2.

Thanks for helping us build Trust content that’s actually useful.

— Jo

[Samia]

Great initiative 👍

This kind of one-pager clearly addresses a real need: simplifying complex topics so they become understandable and actionable for decision-makers (exec, risk, procurement). A real time-saver during validation phases.

That said, we can also see the underlying objective: helping to remove the remaining barriers to Cloud adoption, especially around data sovereignty and security concerns.

And in the end, it’s a smart move — pedagogy and transparency are often the most effective ways to bring hesitant organizations on board.

[Richard Scholtes]

I think you nailed the format for exec levels.

And all of your considered topics sound helpful to me. I would especially like to see Vulnerability Management to be done next. 

[Marcelo Viana de Siqueira]

Hello Atlassian team,

I would like to ask whether there is any planned timeline for data residency in Brazil.

This is a crucial point in our organization’s evaluation of a potential migration from Jira Data Center to Atlassian Cloud. Having data residency available in Brazil would be a key factor in supporting our internal assessment, especially from the perspectives of compliance, governance, and risk evaluation.

Any update, roadmap indication, or guidance you can share on this topic would be greatly appreciated.

Thank you.

[AZAPI]

Really appreciate the effort to make complex compliance topics easier to understand. Having a concise resource for executives and procurement teams can save a lot of time during security reviews.

The one-pager format feels practical, especially for organizations evaluating cloud adoption. Looking forward to seeing the vulnerability management and AI security overviews next.

[AZAPI]

Interesting approach. The focus on explainable AI workflows is what stood out to me. Many teams already have plenty of monitoring data, but connecting logs, metrics, and incidents into actionable insights is often the bigger challenge. Curious to see how it performs in complex production environments.

[Andreas Krupp _catworkx_]

Hi @Joanna Milewska ,

would it be possible to get on call on this topic - ideally with you, or someone from the trust team, and an infrastructure architect from you. I think this kind of One Pager is what is needed. But it does not respond to the level of transparency required by many of the upcoming big and more complex cloud migration customers.

For example, what the one pager does not clarify in enough detail is:

• Which services process information independently of the data residency setting. Example: Automation, Rovo, JSM Operations, etc.. This is a big topic for some of our customers
• Which services process data outside the AWS cloud, meaning that data goes over the internet. Examples could be 3rd Party Apps or even Atlassian Services that have not yet been migrated into the AWS environment of Atlassian

What really needs to be addressed in my view is the data processing residency alongside data residency AND the roadmap items to bring both closer together. For example: I have heard that EU data processing residency for AI is coming (not in full, but partially) - but I cannot find this information on the public roadmap. And all the while advising customers on architecture, this is a very important piece of information that seems to be held back for whatever reason.

[Joanna Milewska]

Yes of course @Andreas Krupp _catworkx_ - please write me an email at jmilewska@atlassian.com and we can make the arrangements, BR, Joanna