DDTC registration and FIPS 140-2 encryption compliance

[Sean Wuttke]

I am trying to find out if Bitbucket Cloud is registered as an authorized user under DDTC and if the encryption of data stored in Bitbucket Cloud meets FIPS 140-2 encryption requirements.

[Ben · Accepted solution]

Hi @Sean Wuttke 

Bitbucket Cloud is certified with industry standards such as SOC II, SOC III, PCI DSS, ISO/IEC 27001, ISO/IEC 27018, and GDPR. A list of compliance documents may be found below:

• https://www.atlassian.com/trust/compliance/resources

Hope this helps.

Cheers!

- Ben (Bitbucket Cloud Support)

[Sean Wuttke]

Thanks Ben, I take it than that the answer is as followed. Bitbucket is not registered as an authorized user with Directorate of Defense Trade Controls (DDTC) and doesn't abide by the FIPS 140-2 encryption requirements. As neither of these seem to be located in the link that you attached.

[Ben]

Hi @Sean Wuttke 

Correct, sorry I should have been more clear.

Upon further digging, I've found that FIPS 140-2 is a requirement for FedRAMP Moderate.

• Achieving FedRAMP Moderate is part of our cloud roadmap and is estimated for Q1 2025 - so this would include the implementation of FIPS 140-2 encryption requirements:
  https://community.atlassian.com/t5/Trust-Security-articles/It-s-official-FedRAMP-Moderate-has-a-new-date-in-cloud/ba-p/2488663

As for DDTC - Atlassian products do comply with United States export controls and economic sanctions regulations and laws regulating international transactions, more information regarding export controls can be found below:

• https://s28.q4cdn.com/541786762/files/doc_downloads/governance/2023/Atlassian-Code-of-Conduct.pdf

Please let me know if further information is required.

Cheers!

- Ben (Bitbucket Cloud Support)