Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
This is Atlassian's official list of subprocessors, meaning the third-party companies that Atlassian authorizes to access or process customer data as part of delivering its cloud products such as Jira, Confluence, and Jira Service Management. The document discloses each subprocessor's name, country of operation, and the category of processing activity performed, covering infrastructure hosting (Amazon Web Services, Google Cloud Platform), analytics, customer support tooling, payment processing, and AI-related functions. Atlassian states that it will provide advance notice of changes to this list, giving customers the opportunity to object to new subprocessors under the terms of its DPA.
This document is Atlassian's publicly disclosed list of third-party subprocessors authorized to process customer data in connection with Atlassian's cloud products and services, published under Atlassian's Data Processing Addendum (DPA) framework, which governs subprocessor engagement as required under GDPR Article 28 and equivalent data protection obligations. The document discloses the names, locations, and processing activities of each subprocessor, establishing that Atlassian engages third parties for functions including cloud infrastructure hosting, analytics, customer support, security monitoring, payment processing, and AI-related processing. The list covers a broad set of subprocessors spanning multiple jurisdictions including the United States, European Economic Area, Australia, and India, with infrastructure providers such as Amazon Web Services and Google Cloud Platform identified as primary hosting subprocessors; the geographic distribution of subprocessors is operationally significant for customers subject to data residency or cross-border transfer restrictions. The document engages GDPR (particularly Articles 28 and 46 on subprocessor contracts and transfer mechanisms), the UK GDPR, the Australian Privacy Act, and potentially CCPA, as Atlassian's customer base and subprocessor network are global. Enterprise customers with contractual data residency commitments or sector-specific regulatory requirements (financial services, healthcare, public sector) should evaluate the subprocessor list against their own DPA obligations, transfer mechanism documentation, and vendor management policies.
The document establishes that customer data processed through Atlassian cloud products is shared with a defined set of third-party subprocessors performing infrastructure hosting, analytics, support, payment, and AI-related functions across multiple jurisdictions. Under these terms, customers operating under GDPR, UK GDPR, or equivalent frameworks are entitled to review this list and, pursuant to Atlassian's DPA, object to new subprocessors added after the customer's contract date. You can monitor this list for updates and submit objections to new subprocessors by following the process described in Atlassian's Data Processing Addendum.
Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.
This document has no published clauses at present. We withheld clauses we had published from this document. Each withholding is recorded in our correction log:
No provisions are listed for this document. The clauses we published for it are no longer published, and we do not list our summary's readings in their place. The 6 we listed from our summary were withheld: none of their quoted text appears in any capture we hold of this document. Clauses we published and later withheld are listed above, each with its correction.
We have not recorded a change to this document since we began capturing it. Monitor includes alerts from a daily check, structured change summaries, and monitoring for up to 20 platforms.
Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.
Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 343 platforms.