Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
This is Atlassian's official list of subprocessors, meaning the third-party companies that Atlassian authorizes to access or process customer data as part of delivering its cloud products such as Jira, Confluence, and Jira Service Management. The document discloses each subprocessor's name, country of operation, and the category of processing activity performed, covering infrastructure hosting (Amazon Web Services, Google Cloud Platform), analytics, customer support tooling, payment processing, and AI-related functions. Atlassian states that it will provide advance notice of changes to this list, giving customers the opportunity to object to new subprocessors under the terms of its DPA.
This document is Atlassian's publicly disclosed list of third-party subprocessors authorized to process customer data in connection with Atlassian's cloud products and services, published under Atlassian's Data Processing Addendum (DPA) framework, which governs subprocessor engagement as required under GDPR Article 28 and equivalent data protection obligations. The document discloses the names, locations, and processing activities of each subprocessor, establishing that Atlassian engages third parties for functions including cloud infrastructure hosting, analytics, customer support, security monitoring, payment processing, and AI-related processing. The list covers a broad set of subprocessors spanning multiple jurisdictions including the United States, European Economic Area, Australia, and India, with infrastructure providers such as Amazon Web Services and Google Cloud Platform identified as primary hosting subprocessors; the geographic distribution of subprocessors is operationally significant for customers subject to data residency or cross-border transfer restrictions. The document engages GDPR (particularly Articles 28 and 46 on subprocessor contracts and transfer mechanisms), the UK GDPR, the Australian Privacy Act, and potentially CCPA, as Atlassian's customer base and subprocessor network are global. Enterprise customers with contractual data residency commitments or sector-specific regulatory requirements (financial services, healthcare, public sector) should evaluate the subprocessor list against their own DPA obligations, transfer mechanism documentation, and vendor management policies.
The document establishes that customer data processed through Atlassian cloud products is shared with a defined set of third-party subprocessors performing infrastructure hosting, analytics, support, payment, and AI-related functions across multiple jurisdictions. Under these terms, customers operating under GDPR, UK GDPR, or equivalent frameworks are entitled to review this list and, pursuant to Atlassian's DPA, object to new subprocessors added after the customer's contract date. You can monitor this list for updates and submit objections to new subprocessors by following the process described in Atlassian's Data Processing Addendum.
Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.
Atlassian has updated this document before. Monitor includes same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.
Cross-platform context
See how other platforms handle AI-Related Subprocessor Disclosure and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 352+ platforms.