Atlassian Subprocessors List (September 2026): Changes and History
Atlassian names 46 subprocessors on its published list. Read from the vendor's own page and re-checked daily.
Last checked September 25, 2026
Official source ↗
Atlassian subprocessors (September 2026)
| # | Subprocessor | Purpose | Location | Data |
|---|---|---|---|---|
| 1 | Amazon Web Services, Inc. | Cloud hosting provider Provision of Atlassian support | EEA (Sweden, Ireland, Germany), Switzerland, UK, Canada, Australia, Singapore, South Korea, USA, India, Japan, Singapore If you’ve enabled Atlassian’s Data Residency feature, certain (in-scope) data is hosted in your chosen region. For details on supported regions, how Data Residency works, see Data Residency: Manage Where Your Data is Hosted, Understand data residency. | Customer Personal Data, created by customer and stored in Applicable Cloud Products, or shared with Atlassian during the provision of support |
| 2 | Clumio, Inc. | Backup solutions provider for Amazon Simple Storage Service (S3) | EEA, UK, Australia, USA, Singapore | Customer Personal Data created by customer and stored in Applicable Cloud Products, or shared with Atlassian during the provision of support |
| 3 | Databricks, Inc. | Infrastructure provider to enable customer data querying, and analytics product features. | USA | Customer Personal Data created by customer and stored in Applicable Cloud Products End User Personal Data created by developers and stored in Forge |
| 4 | Google LLC | File Storage | USA | Customer Personal Data created by customer and stored in DX |
| 5 | Microsoft Corporation | Cloud hosting provider | USA, Australia, Netherlands | Customer Personal Data created by customer and stored in Applicable Cloud Products |
| 6 | MongoDB, Inc. | Cloud hosting provider for JSM Chat (formerly Halp) | USA | Customer Personal Data created by customer and stored in Applicable Cloud Products |
| 7 | NetApp, Inc. | Cloud hosting provider | USA | Customer Personal Data created by customer and stored in Applicable Cloud Products |
| 8 | Salesforce, Inc. (Heroku) | Cloud services provider | USA | Customer Personal Data created by customer and stored in Applicable Cloud Products |
| 9 | Snowflake, Inc. | Cloud database provider | USA | Customer Personal Data created by customer and stored in Applicable Cloud Products |
| 10 | Cantab Research Ltd (trading as Speechmatics) | Transcription services | USA | Customer Personal Data created by customer, in particular, personal data contained in product notice communications and user-initiated shared video recordings including associated comments and SMS/MMS messages |
| 11 | Work OS, Inc. | SCIM provisioning | USA | Customer Personal Data created by customer and stored in DX |
| 12 | Mailgun Technologies, Inc. | Communications technology provider for product notifications | USA, EEA | Customer Personal Data created by customer, in particular, personal data contained in product notice communications |
| 13 | Mailchimp | Communications technology provider for product notifications and video sharing over email | USA | Customer Personal Data created by customer, in particular, personal data contained in product notice communications and user-initiated shared video recordings including associated comments and email messages |
| 14 | MessageBird USA, Inc, (d/b/a Bird) | Communications technology provider for product notifications | USA, EEA | Customer Personal Data created by customer, in particular, personal data contained in product notice communications End User Personal Data created by developers and stored in Forge |
| 15 | Vonage APIs (formerly Nexmo, Inc.) | Communications technology provider | USA, UK, Singapore | Customer Personal Data created by customer, in particular, personal data contained in text and voice communications |
| 16 | OneSignal | Communications technology provider for mobile product notifications and video sharing | USA | Customer Personal Data created by customer, in particular, personal data contained in product notice communications and user-initiated shared video recordings including associated comments and SMS/MMS messages |
| 17 | Plivo, Inc. | Communications technology provider for product notifications | USA | Customer Personal Data created by customer, in particular, personal data contained in product notice communications |
| 18 | Twilio Inc. | Communications technology provider for product notifications | USA | Customer Personal Data created by customer, in particular, personal data contained in product notice communications End User Personal Data created by developers and stored in Forge |
| 19 | Cloudflare, Ltd. | Content delivery network provider Hosting provider for the Remote Model Context Protocol (MCP) Server | Customer traffic is processed globally at the data center closest to the end user. | Customer Personal Data created by customer and stored in Applicable Cloud Products |
| 20 | e-Core Soluções em Tecnologia da Informaçiupão Ltda. | Customer service, support, and cloud migration service provider | Brazil, Mexico | Customer Personal Data created by customer if shared with Atlassian via attachments in support tickets |
| 21 | Partner Hero | Customer service and technical support | Philippines, Romania, South Africa | Customer Personal Data created by customer shared during Loom support communications |
| 22 | SoftServe, Inc. | Customer service, outsourced engineering and technical support | Bulgaria, Poland, United States | Customer Personal Data created by customer and stored in Applicable Cloud Products End User Personal Data created by developers and stored in Forge |
| 23 | Telus, Inc. | Customer service | Romania | Customer Personal Data created by customer if shared with Atlassian via attachments in support tickets |
| 24 | Zendesk | Customer service and technical support | USA | Customer Personal Data created by customer shared during Loom support communications |
| 25 | Amazon Web Services, Inc. (AWS Bedrock) | Generative AI services provider for intelligence product features | USA, EEA (Germany, Sweden, Italy, Spain, Ireland, France) South Africa, Japan, South Korea, India, Singapore, Australia, Indonesia, Canada, Switzerland, UK, Bahrain, Mexico, Brazil | Customer Personal Data created by customer and stored in Applicable Cloud Products |
| 26 | Google Vertex AI | Generative AI services provider for intelligence product features | USA, EEA (Belgium, Netherlands, Finland), Singapore, Taiwan | Customer Personal Data created by customer and stored in Applicable Cloud Products |
| 27 | OpenAI, L.L.C. | Generative AI services provider for intelligence product features For the provision of Atlassian support | USA | Customer Personal Data created by customer and stored in Applicable Cloud Products, or shared with Atlassian during the provision of support |
| 28 | Twilio, Inc (Twilio-Segment) | Data analytics service | USA | Customer Personal Data created by customer and stored in Applicable Cloud Products |
| 29 | Crowdstrike | — | USA | — |
| 30 | Okta, Inc. | — | USA | — |
| 31 | Tenable Holdings, Inc. | — | USA | — |
| 32 | Atlassian B.V. | — | Kingdom of the Netherlands | — |
| 33 | Atlassian Canada Inc. | — | Canada | — |
| 34 | Atlassian France S.A.S. | — | French Republic | — |
| 35 | Atlassian Germany GmbH | — | Federal Republic of Germany | — |
| 36 | Atlassian India LLP | — | Republic of India | — |
| 37 | Atlassian K.K. | — | Japan | — |
| 38 | Atlassian Korea Ltd. | — | Republic of Korea | — |
| 39 | Atlassian New Zealand | — | New Zealand | — |
| 40 | Atlassian Philippines, Inc. | — | Republic of the Philippines | — |
| 41 | Atlassian Poland sp.z.o.o | — | Republic of Poland | — |
| 42 | Atlassian Pte. Ltd. | — | Republic of Singapore | — |
| 43 | Atlassian Pty. Ltd. | — | Commonwealth of Australia | — |
| 44 | Atlassian (UK) Operations Ltd. | — | United Kingdom of Great Britain, Northern Ireland | — |
| 45 | Atlassian US, Inc. | — | United States of America | — |
| 46 | Opsgenie Yazılım Anonim Şirketi | — | Republic of Türkiye | — |
Get an email when Atlassian changes its subprocessors
ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.
Key DPA terms at Atlassian
What Atlassian's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?
- Breach notification
-
Within 72 hours
“Atlassian must notify Customer without undue delay and, where feasible, no later than seventy-two (72) hours after becoming aware of a Security Incident.”
DPA, www.atlassian.com ↗ - Notice of a new subprocessor
-
30 days ahead
“Atlassian will provide such notice, to those emails subscribed, at least thirty (30) days before allowing any new Sub-processor to Process Customer Personal Data (the "Sub-processor Notice Period").”
DPA, www.atlassian.com ↗ - Transfers outside the EU
-
Standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions
“The EU SCCs are hereby incorporated into this DPA by reference as follows:”
“Atlassian participates in and certifies compliance with the Data Privacy Framework.”
“to a country outside of Europe that is not subject to an adequacy decision, the following applies:”
DPA, www.atlassian.com ↗ - Customer data after the contract ends
-
Deleted or returned when the contract ends
“Following expiration or termination of the Agreement, Atlassian must, in accordance with the Documentation, delete all Customer Personal Data.”
DPA, www.atlassian.com ↗ - Audit rights
-
Once a year
“occur no more than once every twelve (12) months; and (iv) restrict its findings to only information relevant to Customer.”
DPA, www.atlassian.com ↗
Documents we track for Atlassian
- AI terms
- checked September 25, 2026 www.atlassian.com ↗
- DPA
- checked September 25, 2026 www.atlassian.com ↗
- Privacy policy
- checked September 25, 2026 www.atlassian.com ↗
- Subprocessor list
- checked September 25, 2026 www.atlassian.com ↗
- Terms of service
- checked September 25, 2026 www.atlassian.com ↗
Change history
Tracking since September 25, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.
Atlassian subprocessors FAQ
- How many subprocessors does Atlassian use?
- Atlassian lists 46 subprocessors on its published list, including Amazon Web Services, Inc., Clumio, Inc., Databricks, Inc., Google LLC, and Microsoft Corporation and 41 more.
- Where does Atlassian process customer data?
- The subprocessors named by Atlassian are located in USA, Singapore, Australia, UK, Canada, and EEA and 46 other locations, as stated on its list.
- How quickly does Atlassian report a personal data breach to customers?
- According to its DPA, Atlassian reports a personal data breach to customers within 72 hours: “Atlassian must notify Customer without undue delay and, where feasible, no later than seventy-two (72) hours after becoming aware of a Security Incident.”
- How much notice does Atlassian give before adding a subprocessor?
- Atlassian's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “Atlassian will provide such notice, to those emails subscribed, at least thirty (30) days before allowing any new Sub-processor to Process Customer Personal Data (the "Sub-processor Notice Period").”
- How does Atlassian transfer personal data outside the EU?
- Atlassian's DPA relies on standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions: “The EU SCCs are hereby incorporated into this DPA by reference as follows:”
- When was Atlassian's subprocessor list last checked?
- ClauseTrail last checked Atlassian's subprocessor list on September 25, 2026. Lists are re-checked daily.
- How do I find out when Atlassian adds or removes a subprocessor?
- ClauseTrail monitors Atlassian's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.