Atlassian Sub-Processors

This document is Atlassian's publicly disclosed list of third-party subprocessors authorized to process customer data in connection with Atlassian's cloud products and services, published under Atlassian's Data Processing Addendum (DPA) framework, which governs subprocessor engagement as required under GDPR Article 28 and equivalent data protection obligations. The document discloses the names, locations, and processing activities of each subprocessor, establishing that Atlassian engages third parties for functions including cloud infrastructure hosting, analytics, customer support, security monitoring, payment processing, and AI-related processing. The list covers a broad set of subprocessors spanning multiple jurisdictions including the United States, European Economic Area, Australia, and India, with infrastructure providers such as Amazon Web Services and Google Cloud Platform identified as primary hosting subprocessors; the geographic distribution of subprocessors is operationally significant for customers subject to data residency or cross-border transfer restrictions. The document engages GDPR (particularly Articles 28 and 46 on subprocessor contracts and transfer mechanisms), the UK GDPR, the Australian Privacy Act, and potentially CCPA, as Atlassian's customer base and subprocessor network are global. Enterprise customers with contractual data residency commitments or sector-specific regulatory requirements (financial services, healthcare, public sector) should evaluate the subprocessor list against their own DPA obligations, transfer mechanism documentation, and vendor management policies.