When do you plan to be SOC 2 compliant and what duration of time will it cover?

[Crissy Shehadeh]

I love your Confluence product and would love to use it at my company but I can't get approval until you are SOC 2 compliant.  I found an article from 2016 saying you were working on it.  Do you still plan to be SOC 2 compliant?  Are there any details you can share that would help me build my case with my company?

thanks!

[Shannon S]

Crissy,

With the exception of Stride, all of our Cloud products are SOC 2 compliant:

• Atlassian Compliance
  
  

Atlassian has achieved SOC certifications for:

• Bitbucket Cloud (Type II)

• Confluence Cloud (Type II)

• Jira Cloud (Type II)

• Stride (Type I)

If you'd like to download a copy of the SOC3 report for Jira and Confluence Cloud, please click here.

Additionally on the page I linked you can find links for our Security and Trust sections that will also help your case.

Let me know if you have any follow-up questions regarding this!

Regards,

Shannon

[Senthivelrajan Lakshmanan]

Shannon,

Any plans for Atlassian StatusPage

Thanks

Senthi

[Shannon S]

Hello Senthi,

Unfortunately, Statuspage has not undergone formal SOC2 or ISO 27001 certification, so we do not have any results to share. The extent of security information that we have published at this time can be found here: 

• Supplementary Security Q&A

Thank you for your understanding!

Regards,

Shannon

[Amrut Bhonsle]

@Shannon S does the SOC compliance cover the plugins/Addon on Atlassian cloud?

[Shannon S]

Hello Amrut,

Great question! This is up to the vendors themselves. We do have a Cloud security program, where vendors who meet passing criteria have the following text in their Marketplace listing:

This vendor has completed the security self-assessment and shared the results with Atlassian.

Cloud app vendors are encouraged to complete a yearly self-assessment of their data security practices. This information is self-reported by vendors, and Atlassian is not responsible for the security or integrity of this app.

Note that accreditation is not required to pass, but is beneficial.

If you want to know about individual add-ons' accreditation, you can contact the vendor directly via the Support tab on their Marketplace listing.

I hope that helps! Let me know if you have any questions.

Regards,

Shannon

[Joao Henrique da Fonseca]

@Shannon S Does the SOC ii compliance also cover Intercom integrations (Jira Cloud  and Intercom for Jira)? 

[Shannon S]

Hello @Joao Henrique da Fonseca,

Intercom integrations are not provided by Atlassian, and are generally managed using a Marketplace add-on. So while Jira Cloud itself is compliant, compliance for Intercom for Jira is up to the vendor, as I mentioned earlier to Amrut. As a part of our Cloud security program, vendors who meet passing criteria have the following text in their Marketplace listing:

This vendor has completed the security self-assessment and shared the results with Atlassian.

Cloud app vendors are encouraged to complete a yearly self-assessment of their data security practices. This information is self-reported by vendors, and Atlassian is not responsible for the security or integrity of this app.

I can see that in particular, Intercom for Jira, has self-assessed their security:

If you have doubts about any other integrations, you can check the Marketplace listing for the integration, or contact the vendor directly if you are unsure.

Take care,

Shannon