Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document discloses that Atlassian engages third-party payment processing subprocessors, establishing that billing and payment card data associated with customer accounts may be processed by named third parties.
This analysis describes what Atlassian's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that payment-related personal data is processed by third-party subprocessors, which is relevant for customers' PCI DSS compliance assessments and for understanding the data flow of financial information through Atlassian's infrastructure.
Interpretive note: The document lists subprocessors by category but does not specify the scope of payment data accessed by each payment subprocessor; the extent of payment data processing must be determined by reference to Atlassian's product and billing documentation.
Under these terms, payment and billing data associated with Atlassian accounts is processed by third-party payment subprocessors. Customers and their finance teams should confirm that these processors meet applicable payment security standards relevant to their own compliance requirements.
Cross-platform context
See how other platforms handle Payment Processing Subprocessor Engagement and similar clauses.
Compare across platforms →Monitoring
Atlassian has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Atlassian subprocessors who process customer data.Excerpt from Atlassian's Sub-Processors
1) REGULATORY LANDSCAPE: Payment Card Industry Data Security Standard (PCI DSS) governs the handling of payment card data and applies to entities that store, process, or transmit cardholder data, including subprocessors. GDPR applies to payment-related personal data processed within the EU. The CFPB has jurisdiction over certain payment processing practices affecting US consumers. 2) GOVERNANCE EXPOSURE: Low to Medium. Payment processing subprocessors are typically PCI DSS certified, and Atlassian's disclosure of these vendors enables customers to assess the payment data processing chain. Enterprise customers with PCI DSS obligations should confirm the certification status of listed payment subprocessors. 3) JURISDICTION FLAGS: US customers should assess whether payment processing subprocessors are subject to CFPB oversight. EU customers should confirm GDPR-compliant data processing agreements are in place for payment data. California customers should assess CCPA applicability to payment personal information. 4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise procurement teams should request PCI DSS attestation documentation from Atlassian for payment subprocessors. DPAs should confirm that payment data processing is limited to the stated purposes and that payment subprocessors are contractually restricted from using payment data for other purposes. 5) COMPLIANCE CONSIDERATIONS: Finance and compliance teams should map payment subprocessors against their organization's PCI DSS scope documentation. Any changes to payment processing subprocessors should trigger a review of PCI DSS scoping and GDPR Article 30 records updates.
This provision establishes that payment-related personal data is processed by third-party subprocessors, which is relevant for customers' PCI DSS compliance assessments and for understanding the data flow of financial information through Atlassian's infrastructure.
Under these terms, payment and billing data associated with Atlassian accounts is processed by third-party payment subprocessors. Customers and their finance teams should confirm that these processors meet applicable payment security standards relevant to their own compliance requirements.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Atlassian.