- Legal information
- Security measures
Security measures
Atlassian’s Technical and Organisational Security Measures
Download PDF
Effective starting: October 7, 2025
Introduction
Security is an essential part of Atlassian’s offerings. This page describes Atlassian’s security program, certifications, policies, and physical, technical, organizational and administrative controls and measures to protect Customer Data and, where indicated below, Customer Materials from unauthorized access, destruction, use, modification or disclosure (the “Security Measures”). The Security Measures are consistent with the commonly-accepted industry standards and practices, including NIST 800-53 controls.
Any capitalized terms used but not defined have the meanings set out in the Agreement or the Data Processing Addendum. Further details on Atlassian’s security posture can be found in our Trust Center and Compliance Resource Center.
1. Access Control
Atlassian maintains a comprehensive set of formal policies, controls, and practices for the appropriate access control when processing Customer Data and Customer Materials, which includes:
1.1. access management policy addressing access control standards, including the framework and the principles for user provisioning;
1.2. designated criticality tiers based on a Zero Trust Model architecture, including the requirements for multi-factor authentication on higher-tier services;
1.3. user provisioning for access to Atlassian systems, applications and infrastructure based on the relevant job role and on the least privilege principle that is enforced through the authentication processes, enabling only authorized personnel to have access to development and build environments (including source code repositories) associated with the Products;
1.4. strict role-based access controls for Atlassian staff, allowing access to Customer Data only on a need-to-know basis;
1.5. segregation of duties including but not limited to (i) access controls reviews, (ii) HR-application managed security groups, and (iii) workflow controls;
1.6. a prior approval of all user accounts by Atlassian’s management before granting access to data, applications, infrastructure, or network components based on the data classification level; regular review of access rights as required by relevant role;
1.7. use of technical controls such as virtual private network (VPN) and multi-factor authentication (MFA) where relevant based on information classification and Atlassian‘s Zero Trust Model architecture;
1.8. centrally managed mobile device management (MDM) solution, including defined lockout periods and posture checks for endpoints and mobile devices;
1.9. identifying and removing redundant and dormant accounts, promptly revoking access through automated and regular review processes.
2. Awareness and Training
Atlassian maintains a comprehensive set of formal policies, controls, and practices for conducting appropriate trainings and security awareness activities, which includes:
2.1. extensive awareness training on security, privacy, and compliance topics for all employees at induction and annually, utilizing diverse formats (online, in-person, and pre-recorded sessions, phishing simulations);
2.2. targeted role-specific training and documentation for employees with elevated privileges to address relevant risks and enhance their specific knowledge as required for their respective roles;
2.3. maintaining all training records in a designated learning management system;