Bill Marriott Atlassian Team

Hi @Christian Bär , thanks for your question. Apologies, it would've been more accurate of us to say that Atlassian products may use the version that is present on the host system as a dependency. Atlassian’s (downloadable) Server and Data Center products use the host operating system SSL Library, so if you have enabled…

Hi all, We wanted to share another update on our investigation and analysis regarding any impact to Atlassian products due to vulnerabilities found in OpenSSL version 3.x. Cloud instances After internal review, Atlassian has determined that none of our cloud offerings directly use the vulnerable versions of OpenSSL 3.x.…

I've sent to your email address Andrew.

We have not yet evaluated for EU 2017/746, however, we recently aligned our practices with HIPAA, which is a US medical data framework. It might be similar enough to help with your evaluation. Please see : https://www.atlassian.com/trust/compliance/resources/hipaa 

Hi Keith - any marketplace vendor can participate in our Marketplace Security-Self Assessment program, see : https://developer.atlassian.com/platform/marketplace/security-self-assessment-program/ While our Cloud Fortified Program can be applicable to Cloud Applications, Server and Data Center app vendors can also…

Hi @Dom Bush - Due to the ability for customer admins to define their own fields in Jira or content in Confluence, we cannot absolutely rule-out logging of PII. However, if we realize that some fields do contain PII, we strip them from logging. We also : * Restrict access to logs generally; * Check if the (schema-defined)…

Our ECCN information can be found at : https://www.atlassian.com/licensing/purchase-licensing#eccn 

Sorry @fred - it's not obvious to me where it displays email addresses. Just shoot me an email at bmarriott@atlassian.com and I can respond there. 

Can you email me directly @Fred Koenders ? Your email isn't shown on your profile. 

@József Markovics-Horváth - Was that related to our Ecosystem Partners? As far as I know, the Ecosystem team has stopped using the Whistic platform to capture responses from Ecosystem partners, but the Ecosystem team is still collecting the responses in another method and adding stats to the app entries in the Marketplace…

Or the direct link is : https://www.atlassian.com/trust/security/security-practices#encryption-of-data

Hi @Daniel Meisen - Our Jira Cloud Profile request link is now also live : Jira Cloud Security Profile.

Hi @Daniel Meisen - Our Confluence request link is now live : Confluence Security Profile The Jira Profile Request Link should be live shortly. Cheers. -bill

Hi @Rajeev Scaria - We now allow customers to perform their own vulnerability scans or penetration tests of our infrastructure or applications. You are welcome to review the results of our Bug Bounty program at our Security Practices page : https://www.atlassian.com/trust/security/security-practices#bug-bountySee our…

Hi @Daniel Meisen - should be within a couple of weeks or so. ;-)

Hi @ph - as stated on https://www.atlassian.com/trust/security/security-testing "Any security vulnerabilities identified in the reports are tracked in our internal Jira as they come through the Bug Bounty intake process and any findings from the Bug Bounty will be triaged and remediated according to our Public Security…

Hi @Amelia Hogg - We understand that it can be a bit of a process to update our software when new advisories or updates are issued. We also want to make sure we address any known vulnerabilities in our products to ensure your applications are safe and secure. Over the last 18 months, we have increased the amount of people…