If Atlassian's confluence or jira products are breached, is Atlassian required to notify impacted customers?

[Stanley St-Fleur]

I'm working with a client (big financial company) and their information security leaders asked about Atlassian's data breach policy.  This is a prerequisite before we can facilitate broad adoption with the client and potential vendors.

[Boris Berenberg]

I would recommend you start by looking at: https://www.atlassian.com/security for more info

Also, is your question about cloud or on premises implementations 

[Nic Brough -Adaptavist-]

I'd raise this with Atlassian Cloud support directly, so you can have a proper dialogue with them and get definitive answers.  (Although someone from Atlassian may well comment here, a support request will definitely get you a response and possibly a lot faster)