Data Residency - Roadmap, Plans, and your Feedback wanted

[#1]

TL;DR: This article is about our overall strategy for Data Residency, including what we’ve shipped, the feedback we’ve heard so far, what we’re planning to ship, and where we need continued feedback. We’re collecting all feedback in our closed group on Security & Compliance: which includes a thread on Data Residency. Join us here! https://community.atlassian.com/t5/Cloud-Security-Compliance/gh-p/cloud-security-compliance

Hello! If we haven’t met yet, I’ve added a quick intro at the bottom of this post. Nice to meet you!

One of my favorite aspects of working here in Atlassian is our core values, and I strive to live them out every day that I’m here. This is why I want to talk about Data Residency in this “Open company, no bullshit” article, and invite you to have very candid conversations with us about our roadmap, provide insights for our planning process, and provide feedback on how we’ve done.

Background on our Data Residency journey so far

Last year, at the end of 2020, we released Data Residency for our Enterprise Cloud plan. When we look across our Data Residency strategy, we view it across 5 key areas: Regions, Products, Licensing, Data Types, and Ecosystem.

The 2020 Data Residency release included the following:

• Regions: Data Residency regions of United States (US-West & US-East) and European Union (Dublin & Frankfurt)

• Products: Jira Software, Confluence, and parts of Jira Service Management (JSM)

• Licensing: Included as part of the Enterprise Cloud plan

• Data Types: Primary data generated by the customer

• Ecosystem: Extended the Connect framework for marketplace app vendors who want to build and deliver data residency for their new customers to their apps.

For more details on what’s included, visit our Data Residency documentation

This was a tremendous effort across multiple teams within Atlassian, over a couple of years, and we are extremely excited about the progress we have made. We also know the journey is not done yet, and so I’d like to share some of the feedback we’ve heard from everyone so far.

The feedback we’ve heard

We’ve been talking to customers of different sizes, from many different parts of the world, and different industries around their data protection requirements. We’ve been investigating where our current offering meets or misses those customers' requirements. The following is a list of the most common pieces of feedback we’ve heard so far, although not an exhaustive list.

• Regions: Customers outside of the US & the EU, would like to see Data Residency offered for their specific region or country

• Products: Customers require more data within JSM to be data resident compliant

• Licensing: Customers with less than 1000 users would like to have an option for Data Residency

• Data Types: Customers would like to know if we’re planning to add user account data as in-scope for data residency

• Ecosystem: Customers using marketplace apps need to have their app data, to be data residency compliant as well

The great news is, we’ve been actively working to prioritize this feedback (among others) and would like to share what we’re working on so far.

What we’re working on

We updated our public-facing roadmap at the end of 2020, which I’d like to walk through here. On our roadmap, I will typically only include really major events and releases, like new regions for data residency. When we prioritize our roadmap for data residency, like many companies, we prioritize against customer need/demand and cost/effort to build. In essence, items with the highest need and lowest effort are prioritized first, with items that have the lowest demand and highest effort prioritized last.

We will be looking at our plans and strategy through the end of our Fiscal Year '22, which ends June 30, 2022.

• Regions: Based on the demand by customers, we are looking to expand into 4 new regions for Data Residency: Australia, United Kingdom, Canada, and Japan. Since Atlassian is deployed on AWS, we require AWS to have a presence in the desired region first. Then we will build out our infrastructure in that region, deploy our services into that region, and activate the region for customer use. For now, any regions that do not currently have an AWS presence will not make our roadmap. In the event that the demand exceeds the effort of using a different cloud vendor, we would review those roadmap items then. We are also keeping a very close eye on AWS’s plans for future region expansions, and as they open up new regions, we will evaluate and reprioritize our roadmap based on the demand in that new region.

• Products: Last year we released data residency for the parts of JSM that also use the same services for storing data as Jira Software. However, customers would like us to add more parts of JSM into data residency. As we announced previously, we combined Jira Service Desk and OpsGenie together, to form Jira Service Management. With respect to other products, Bitbucket, Trello, etc., we are currently investigating and assessing demand and customer needs.

• Licensing: We plan to offer data residency to all customer sizes, independent of our Enterprise plan - stay tuned for updates in this area in the next few weeks.

• Data Types: As a reminder, you can view which data types for which products are included in our data residency offering here: visit our Data Residency documentation. We are currently investigating whether we need to bring user account data into the data residency fold. While we do not have plans today to bring user account data into data residency, this is still an area we are working with customers, partners, and our peers in the tech industry to see what is the right course of action for you. We are actively collecting feedback on this, and ask for your help below.

• Ecosystem: As mentioned above, we currently enable marketplace app vendors to build data residency capabilities into their apps for new customers to their apps. This does require the marketplace vendor to have that presence in the region required, and today isn’t something that we can help them with. We are currently working on several fronts here: 1) we want to enable marketplace app vendors to give data residency to existing customers of their apps, provided they have the data stored in the desired region, 2) we are working to help our partners assess the demand for data residency in the regions, so they can make the business decisions they need to take on the added cost and support for additional regions, and 3) we’re working on how we can make this easier for marketplace app vendors by providing cloud storage so they can inherit our data residency capabilities natively.

Where we need your help

This is where you come in! We can never make these decisions in a vacuum! We have been engaging with a large number of customers, partners, and peers in the tech industry around everything related to data residency. We’ve had a lot of 1:1 conversations, and we want to scale these conversations to many more people. If you would like to help shape the future of data residency for Atlassian, please join our closed group on security & compliance, where you will find several discussions going on, including a thread specifically dedicated to Data Residency:

https://community.atlassian.com/t5/Cloud-Security-Compliance/gh-p/cloud-security-compliance

More specifically we are actively looking for more feedback on the following:

1. User account data stored in the region. What are your requirements around this, and how can we help you meet your needs.

2. The external regulations and internal policies you have to adhere to when considering data residency needs.

3. Bringing data residency to customers with less than 1000 users.

4. New regions we are expanding into.

Of course, this is not an exhaustive list, but a great place to start. We look forward to you joining us for more in-depth conversations and feedback!

Stay across the latest with What’s new? Updates related to the server end of sale and support – a quick recap of the updates, resources, and answers that we're prioritizing in response to listening to your feedback.

By the way, who is this RJ person?

Hi! Although not new to Atlassian, I am new to the Cloud Product Management team, having switched teams in October 2020. My responsibility is primarily for Enterprise Cloud Data Management, of which my two primary focuses to date are Data Residency and Backup & Restore; both of which are needs that extend beyond our Enterprise customers. My favorite activity at work is jumping into any conversation with a customer or partner, and sparing out our plans, hearing your feedback and needs, and making sure we’re able to address as many of them as we can together.

If you’d like to spend 30 minutes with me on a call and talk to me about how your company handles data today, I’d love to get that insight. Let me know, and we’ll set up some time!

If you’re on a call with me, you’ll probably spot my cat jumping into my lap, looking for some food! I recently moved to Denver, Colorado - so when I’m not busy at work, I love driving through the mountains.

[Stuart Capel - London]

Thanks for the data residency documentation link! This will come in handy 

[RJ Gazarek]

@Stuart Capel - London no problem!  Also, just a quick note, we are making an update to the documentation soon to reflect the state of JSM with respect to data residency, since we do cover some of the JSM services, even though we don't reflect that yet in the documentation. 

[Stuart Capel - London]

Awesome - thanks!

[Nigel Budd (CV)]

Terrific summary of your new initiatives, all very welcome.  Please don't forget BitBucket! Happy to have a call anytime.

[Alexis Robert]

Great update, the ability to purchase Data Residency as a separate product is perfect for most small-medium sized customers who can't afford Premium.

[RJ Gazarek]

@Nigel Budd (CV) glad to hear :) And yes, BitBucket is on the back of my mind, but we're still waiting to hear from more customers on the demand for this one, before we start the investment.  We're not hearing it very much, so please join the closed group, and let's talk about that.

@Alexis Robert yup! We're not sure what that will look like quite yet, but we know we want to make sure we give people a better option than to purchase Enterprise if they don't have the user base to meet the minimum tier requirements.  Data Residency is not an Enterprise only concern, we know that, we see that, we hear that - we're working to address it :) 

[Vero Rivas]

Hi @RJ Gazarek 

   Great, many thanks !!!

Cheers

[RJ Gazarek]

Hi @Vero Rivas

You're welcome! let me know if I can help answer any questions here or in our discussion group

[Ignacio Pulgar]

Thank you @RJ Gazarek ! :)

[Kristin Lyons]

Thanks!

[RJ Gazarek]

Hi @Kristin Lyons & @Ignacio Pulgar - good to see you! And you're welcome, I want to make sure I'm keeping us open about our strategy and direction.  Let me know if you have any questions, and don't forget to join us in our compliance & security group for more discussion and feedback. https://community.atlassian.com/t5/Cloud-Security-Compliance/gh-p/cloud-security-compliance

[Brant Schroeder]

Thanks for the information it is very useful and timely.

[Laurens Coppens]

Thanks for the effort and update, glad to hear that the need for data residency for non enterprise customers is heavily needed to stay compliant.

We have a lot of 50-100 user customers who require this and are "begging" to go to cloud but can't due to data residency.

[Martin Bayer _MoroSystems_ s_r_o__]

Hi @RJ Gazarek thank you for the information. I spent a hard time on LinkedIn with justifying data residency, but then I was pointed to comments on https://jira.atlassian.com/browse/CLOUD-11064... and I really don't have a "positive" reaction.

I remember you have specialized GDPR team (if I remember correctly). Can anyone react to these comments with GDPR vs. Patriot Act, Cloud Act, FISA. It is too complicated for me :).

[RJ Gazarek]

@Martin Bayer _MoroSystems_ s_r_o__ join us in the discussion group and read through some of the threads and discussions going on there.  If you still need more clarity, then feel free to ask anything specifically and I'll try my best to answer it and clear it up! 

[Deepanshu Natani]

Thanks for sharing this update.

[Kesha Thill]

Hi all! just an update on data residency for you all - we recently announced that data residency will be included in our Standard and Premium cloud plans later this year. To learn more and sign up for updates, visit our page here. 

To see what else we're working (like additional geographies and functionality) related to data residency, visit our cloud roadmap here.

[Tilo Schneider]

@RJ Gazarek Thanks for this article and @Kesha Thill for the update about data residency. It's good to see it will be included in Standard and Premium cloud plans.

[Purna Chandra {Appfire}]

@RJ Gazarek 
how does data residency work with Backups

consider a hypothetical scenario 

• Customer data is pinned to EU region
  • The data is stored in few of AWS EU regions
  • the backups are taken as mentioned in the data-management link.
• The customer moves the data to US region 
  • the data is moved to US regions from EU 
  • checks are done that data is moved 
  • and deleted in the EU region

After these steps, we still have customer data in the EU region in the form of backup.
also, how is backup restore handled in such a scenario?

Is my understanding correct with respect to data residency and backups? if not can you share details 

[Purna Chandra {Appfire}]

@RJ Gazarek 

Can you point me to guidelines for App Developers on Data residency, especially the questions from my previous comment please.