How is the data that is put into JIRA encrypted? How is the data stored at rest? Who in the organization (assuming Atlassian) would have access to the data we put onto the software?

[Mike Y]

is the data that is put into JIRA encrypted? How is the data stored at rest? Who in the organization (assuming Atlassian) would have access to the data we put onto the software? – Also we have not decided on cloud or our server, is there a security difference or a cost difference?

[Nic Brough -Adaptavist-]

On Cloud, see https://www.atlassian.com/trust/policies/cloud-security

There are huge differences in security between Cloud and Server, but basically, read the above, and then think about how you'd secure any web-application if you're running it within your firewalls (i.e. a server, maybe firewalled off from the internet, encrypted databases if you do them, etc)

For cost, see https://www.atlassian.com/software/jira/pricing?tab=host-in-the-cloud and flip between the server and Cloud tabs.