Timeline for Implementation of Data Encryption at Rest in SaaS Version?

[Jerry Brown]

I work for a financial services organization, and we have to be in compliance with New York State Department of Financial Services' (NY DFS) 23 NYCRR 500 cybersecurity requirements for financial security companies (http://www.dfs.ny.gov/legal/regulations/adoptions/dfsrf500txt.pdf). In fact, all financial services companies that are doing business with New York in any capacity (which is most of them), need to adhere to these requirements. One of those requirements is that all protected data will be encrypted both at rest and in transit.

Is this level of data encryption on Atlassian's roadmap for the JIRA SaaS version? If so, is there an implementation date that I can communicate to our security community?

Thanks.

[lauren · Accepted solution]

Hi @Jerry Brown, @Eric Allard, and @Michael Daoust

I have an update for you – we recently announced that Atlassian now encrypts customer data in transit and at rest.

Data drives on servers holding customer data and attachments in Jira Software Cloud, Jira Service Desk Cloud, Jira Core Cloud, Confluence Cloud, Statuspage, OpsGenie, and Trello use full disk, industry-standard AES-256 encryption at rest. 

To learn more, please see our Security Practices page.

We post updates related to security, privacy, compliance, and more in our Trust & Security group. Feel free to post related questions and feedback there! 

Best,

Lauren

[Eric Allard]

This seems a required feature for our business adoption as well.

[Michael Daoust]

I would like to know if this is on the road map for similar reasons.