Bill Marriott Atlassian Team

What are Standard Contractual Clauses (SCCs)? * OnJun 4, 2021, an updated version of the Standard Contractual Clauses (or SCCs) was published by lawmakers in the European Union (EU) and they gave all companies untilSep 27, 2021, to abide by these new regulations. * The SCCs allow companies providing services to European…

On November 1, OpenSSL published a security advisory detailing high severity vulnerabilities in version 3.x of their library, also known as CVE-2022-3602 and CVE-2022-3786. Atlassian kicked off the incident management process to assess the impact of this vulnerability across the Atlassian products, platform and ecosystem.…

Following on our first ever Annual Bug Bounty Report from 2021, we have updated this report to reflect a full year of statistics and data about our Bug Bounty Programs as part of our overall Vulnerability Management Program. The Annual Bug Bounty Report includes statistics and data for the July 2021 to June 2022 timeframe,…

Following on our first ever Annual Bug Bounty Report from 2021, this year for the first time, we are publishing an in-depth report detailing a full year of statistics and data about our Security Incident Management program. The Annual Security Incident Report includes statistics and data for the July 2021 to June 2022…

Atlassian maintains submissions to the Cloud Security Alliance (CSA) STAR Registry for our major Cloud Services. The STAR Registry hosts the Consensus Assessment Initiative Questionnaire (CAIQ), which is a spreadsheet made up of questions and responses to common cloud security practices. Atlassian originally completed the…

We maintain an always-on bug bounty to identify and triage issues in our products and services. Many customers ask us for ‘penetration reports’ or similar - basically a report from a third party that shows that we are testing the security of our own products and services. We believe our always-on bug bounty, with more than…

Atlassian maintains submissions to the Cloud Security Alliance (CSA) STAR Registry for our major Cloud Services. The STAR Registry hosts the Consensus Assessment Initiative Questionnaire (CAIQ), which is a spreadsheet made up of questions and responses to common cloud security practices. Atlassian originally completed the…

We maintain an always-on bug bounty to identify and triage issues in our products and services. Many customers ask us for ‘penetration reports’ or similar - basically a report from a third party that shows that we are testing the security of our own products and services. We believe our always-on bug bounty, with more than…

Atlassian’s Trust team now has a completed response for the Higher Education Cloud Vendor Assessment Toolkit (HECVAT) for our Cloud products. What is HECVAT? The HECVAT is a structured questionnaire for Cloud Vendors to complete detailing many common operational, technical, and organizational controls that are relevant to…

Atlassian’s Trust team has recently completed Product Security Profiles for our Halp product, adding to the existing Jira Cloud, Confluence Cloud, Bitbucket Cloud, Trello, Opsgenie, Statuspage and Jira Align Security Profiles, to provide an additional mechanism for our customers to request information about our security…

Atlassian maintains submissions to the Cloud Security Alliance (CSA) STAR Registry for our major Cloud Services. The STAR Registry hosts the Consensus Assessment Initiative Questionnaire (CAIQ), which is a spreadsheet made up of over 300 questions and responses to common cloud security practices. Atlassian originally…

We maintain an always on bug bounty to identify and triage issues in our products and services. Many customers ask us for ‘penetration reports’ or similar - basically a report from a third-party that shows that we are testing the security of our own products and services. We believe our always-on bug bounty, with more than…

We maintain an always on bug bounty to identify and triage issues in our products and services. Many customers ask us for ‘penetration reports’ or similar - basically a report from a third-party that shows that we are testing the security of our own products and services. We believe our always-on bug bounty, with more than…

Atlassian maintains submissions to the Cloud Security Alliance (CSA) STAR Registry for our major Cloud Services. The STAR Registry hosts the Consensus Assessment Initiative Questionnaire (CAIQ), which is a spreadsheet made up of over 300 questions and responses to common cloud security practices. Atlassian originally…

As we highlight each quarter, we maintain an always-on bug bounty to identify and triage security vulnerabilities in our products and services. Many customers ask us for ‘penetration reports’ or similar - a report from a third-party that shows that we are testing the security of our own products and services. We believe…

We maintain an always on bug bounty to identify and triage issues in our products and services. Many customers ask us for ‘penetration reports’ or similar - basically a report from a third-party that shows that we are testing the security of our own products and services. We believe our always-on bug bounty, with more than…

We maintain an always on bug bounty to identify and triage issues in our products and services. Many customers ask us for ‘penetration reports’ or similar - basically a report from a third-party that shows that we are testing the security of our own products and services. We believe our always-on bug bounty, with more than…

Atlassian’s Trust team has recently completed Product Security Profiles to provide an additional mechanism for our customers to request information about our security practices and program from our team. Whistic is a leader in vendor risk management and works with companies like Okta, Airbnb, and Zynga. Many of our Support…

Atlassian maintains submissions to the Cloud Security Alliance (CSA) STAR Registry for our major Cloud Services. The STAR Registry hosts the Consensus Assessment Initiative Questionnaire (CAIQ), which is a spreadsheet made up of ~300 questions and responses to common cloud security practices. Atlassian originally completed…

We maintain an always on bug bounty to identify and triage issues in our products and services. Many customers ask us for ‘penetration reports’ or similar - basically a report from a third-party that shows that we are testing the security of our own products and services. We believe our always-on bug bounty, with more than…

Atlassian maintains submissions to the Cloud Security Alliance (CSA) STAR Registry for our major Cloud Services. The STAR Registry hosts the Consensus Assessment Initiative Questionnaire (CAIQ), which is a spreadsheet made up of ~300 questions and responses to common cloud security practices. Atlassian originally completed…

We maintain an always on bug bounty to identify and triage issues in our products and services. Many customers ask us for ‘penetration reports’ or similar - basically a report from a third-party that shows that we are testing the security of our own products and services. We believe our always-on bug bounty, with more than…

We maintain an always on bug bounty to identify and triage issues in our products and services. Many customers ask us for ‘penetration reports’ or similar - basically a report from a third-party that shows that we are testing the security of our own products and services. We believe our always-on bug bounty, with more than…

At Atlassian, we are well aware of the importance of the data that you, our customers, store in our products. We aim to give you insight on all our products, but we’d like to start with Confluence and the Jira product family, including Jira Software, Jira Service Desk, and Jira Core. There are two primary goals of tenant…

We maintain an always on bug bounty to identify and triage issues in our products and services. Many customers ask us for a copy of a recent ‘penetration reports’ or similar - basically a report from a third-party that shows that we are testing the security of our own products and services. We believe our always-on bug…

We’ve heard from many of you - our customers - that you want more details about how we manage your data in our cloud. In many cases, the customers I personally hear from want to make sure that their data is available to them, when they want it, where they want it. There’s good news! We have published a detailed description…

We have re-certified for Payment Card Industries (PCI) for all of our major products. Specifically, we achieved certification for Jira, Confluence, Bitbucket and :LearnDot: as they use the same payment gateway. We achieved certification for the Trello payment gateway, and the Statuspage payment gateway and the…