Hi Community,
If you've ever tried to get a Marketplace app approved by your security team, you know how long that questionnaire can take. So we wanted to share some news, and a bit of what we learned on the way.
On October 27, 2026, ActivityTimeline for Jira Cloud received the Atlassian Enterprise Certified badge. As of today, 44 apps from 15+ vendors hold it, and you can see the full list with the Marketplace search filter.
What does the badge check?
Atlassian Enterprise Certified is open to Forge cloud apps and goes beyond the baseline security requirements every Marketplace app has to meet. Atlassian's requirements list 26 checks, including:
- An annual penetration test and a public bug bounty
- SOC 2 Type II or ISO 27001
- Data Residency support and encryption at rest for data stored outside Atlassian
- A public status page, a documented incident response process, and a 24-hour response to critical support issues
- A VPAT for accessibility and, for apps that use AI, a public AI usage policy
The checks continue after the badge is granted. Atlassian keeps scanning code and runs random support and security incident tests.
What about Cloud Fortified?
Atlassian has stopped accepting new Cloud Fortified apps and will phase the program out by the end of 2026. ActivityTimeline was among the first 25 Cloud Fortified apps in 2021, so for us this is the next step. If your team relied on Cloud Fortified in past vendor reviews, this is the badge to look for now.
How to use it in your own review
Open any certified app's Marketplace listing, check the badge under Trust Signals, and read the Privacy & Security tab. For ActivityTimeline, our Trust Center has the SOC 2 Type II report, the ISO/IEC 27001:2022 certificate, the data flow diagram and other documents, available on request.
We wrote up the details, including where ActivityTimeline stores data, in our blog post and Trust Center. Happy to answer questions in the comments.
