How many subprocessors does Atlassian use?

Atlassian lists 46 subprocessors on its published list, including Amazon Web Services, Inc., Clumio, Inc., Databricks, Inc., Google LLC, and Microsoft Corporation and 41 more.

Where does Atlassian process customer data?

The subprocessors named by Atlassian are located in USA, EEA, Singapore, Australia, Canada, and Japan and 39 other locations, as stated on its list.

How quickly does Atlassian report a personal data breach to customers?

According to its DPA, Atlassian reports a personal data breach to customers within 72 hours: “Atlassian must notify Customer without undue delay and, where feasible, no later than seventy-two (72) hours after becoming aware of a Security Incident.”

How much notice does Atlassian give before adding a subprocessor?

Atlassian's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “Atlassian will provide such notice, to those emails subscribed, at least thirty (30) days before allowing any new Sub-processor to Process Customer Personal Data (the "Sub-processor Notice Period").”

How does Atlassian transfer personal data outside the EU?

Atlassian's DPA relies on standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions: “The EU SCCs are hereby incorporated into this DPA by reference as follows:”

When was Atlassian's subprocessor list last checked?

ClauseTrail last checked Atlassian's subprocessor list on November 9, 2026 and last saw it change on October 22, 2026. Lists are re-checked daily.

How do I find out when Atlassian adds or removes a subprocessor?

ClauseTrail monitors Atlassian's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Atlassian Subprocessors List (November 2026): Changes and History

Atlassian names 46 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked November 9, 2026 Last change October 22, 2026 Official source ↗

Atlassian subprocessors (November 2026)

#	Subprocessor	Purpose	Location	Data
1	Amazon Web Services, Inc.	Cloud hosting providerProvision of Atlassian support	EEA, Sweden, Ireland, Germany, Switzerland, United Kingdom, Canada, Australia, Singapore, South Korea, United States, India, Japan	Customer Personal Data, created by customer and stored in Applicable Cloud Products, or shared with Atlassian during the provision of support
2	Clumio, Inc.	Backup solutions provider for Amazon Simple Storage Service (S3)	EEA, UK, Australia, USA, Singapore	Customer Personal Data created by customer and stored in Applicable Cloud Products, or shared with Atlassian during the provision of support
3	Databricks, Inc.	Infrastructure provider to enable customer data querying, and analytics product features.	USA	Customer Personal Data created by customer and stored in Applicable Cloud ProductsEnd User Personal Data created by developers and stored in Forge
4	Google LLC	File Storage	USA	Customer Personal Data created by customer and stored in DX
5	Microsoft Corporation	Cloud hosting provider	USA, Australia, Netherlands	Customer Personal Data created by customer and stored in Applicable Cloud Products
6	MongoDB, Inc.	Cloud hosting provider for JSM Chat (formerly Halp)	USA	Customer Personal Data created by customer and stored in Applicable Cloud Products
7	NetApp, Inc.	Cloud hosting provider	USA	Customer Personal Data created by customer and stored in Applicable Cloud Products
8	Salesforce, Inc. (Heroku)	Cloud services provider	USA	Customer Personal Data created by customer and stored in Applicable Cloud Products
9	Snowflake, Inc.	Cloud database provider	USA	Customer Personal Data created by customer and stored in Applicable Cloud Products
10	Cantab Research Ltd (trading as Speechmatics)	Transcription services	USA	Customer Personal Data created by customer, in particular, personal data contained in product notice communications and user-initiated shared video recordings including associated comments and SMS/MMS messages
11	Work OS, Inc.	SCIM provisioning	USA	Customer Personal Data created by customer and stored in DX
12	Mailgun Technologies, Inc.	Communications technology provider for product notifications	USA, EEA	Customer Personal Data created by customer, in particular, personal data contained in product notice communications
13	Mailchimp	Communications technology provider for product notifications and video sharing over email	USA	Customer Personal Data created by customer, in particular, personal data contained in product notice communications and user-initiated shared video recordings including associated comments and email messages
14	MessageBird USA, Inc, (d/b/a Bird)	Communications technology provider for product notifications	USA, EEA	Customer Personal Data created by customer, in particular, personal data contained in product notice communicationsEnd User Personal Data created by developers and stored in Forge
15	Vonage APIs (formerly Nexmo, Inc.)	Communications technology provider	USA, UK, Singapore	Customer Personal Data created by customer, in particular, personal data contained in text and voice communications
16	OneSignal	Communications technology provider for mobile product notifications and video sharing	USA	Customer Personal Data created by customer, in particular, personal data contained in product notice communications and user-initiated shared video recordings including associated comments and SMS/MMS messages
17	Plivo, Inc.	Communications technology provider for product notifications	USA	Customer Personal Data created by customer, in particular, personal data contained in product notice communications
18	Twilio Inc.	Communications technology provider for product notifications	USA	Customer Personal Data created by customer, in particular, personal data contained in product notice communicationsEnd User Personal Data created by developers and stored in Forge
19	Cloudflare, Ltd.	Content delivery network providerHosting provider for the Remote Model Context Protocol (MCP) Server	—	Customer Personal Data created by customer and stored in Applicable Cloud Products
20	e-Core Soluções em Tecnologia da Informaçiupão Ltda.	Customer service, support, and cloud migration service provider	Brazil, Mexico	Customer Personal Data created by customer if shared with Atlassian via attachments in support tickets
21	Partner Hero	Customer service and technical support	Philippines, Romania, South Africa	Customer Personal Data created by customer shared during Loom support communications
22	SoftServe, Inc.	Customer service, outsourced engineering and technical support	Bulgaria, Poland, United States	Customer Personal Data created by customer and stored in Applicable Cloud ProductsEnd User Personal Data created by developers and stored in Forge
23	Telus, Inc.	Customer service	Romania	Customer Personal Data created by customer if shared with Atlassian via attachments in support tickets
24	Zendesk	Customer service and technical support	USA	Customer Personal Data created by customer shared during Loom support communications
25	Amazon Web Services, Inc. (AWS Bedrock)	Generative AI services provider for intelligence product features	USA, EEA, Germany, Sweden, Italy, Spain, Ireland, France South Africa, Japan, South Korea, India, Singapore, Australia, Indonesia, Canada, Switzerland, UK, Bahrain, Mexico, Brazil	Customer Personal Data created by customer and stored in Applicable Cloud Products
26	Google Vertex AI	Generative AI services provider for intelligence product features	USA, EEA, Belgium, Netherlands, Finland, Singapore, Taiwan	Customer Personal Data created by customer and stored in Applicable Cloud Products
27	OpenAI, L.L.C.	Generative AI services provider for intelligence product featuresFor the provision of Atlassian support	USA	Customer Personal Data created by customer and stored in Applicable Cloud Products, or shared with Atlassian during the provision of support
28	Twilio, Inc (Twilio-Segment)	Data analytics service	USA	Customer Personal Data created by customer and stored in Applicable Cloud Products
29	Crowdstrike	—	USA	—
30	Okta, Inc.	—	USA	—
31	Tenable Holdings, Inc.	—	USA	—
32	Atlassian B.V.	—	Kingdom of the Netherlands	—
33	Atlassian Canada Inc.	—	Canada	—
34	Atlassian France S.A.S.	—	French Republic	—
35	Atlassian Germany GmbH	—	Federal Republic of Germany	—
36	Atlassian India LLP	—	Republic of India	—
37	Atlassian K.K.	—	Japan	—
38	Atlassian Korea Ltd.	—	Republic of Korea	—
39	Atlassian New Zealand	—	New Zealand	—
40	Atlassian Philippines, Inc.	—	Republic of the Philippines	—
41	Atlassian Poland sp.z.o.o	—	Republic of Poland	—
42	Atlassian Pte. Ltd.	—	Republic of Singapore	—
43	Atlassian Pty. Ltd.	—	Commonwealth of Australia	—
44	Atlassian (UK) Operations Ltd.	—	United Kingdom of Great Britain, Northern Ireland	—
45	Atlassian US, Inc.	—	United States of America	—
46	Opsgenie Yazılım Anonim Şirketi	—	Republic of Türkiye	—

Get an email when Atlassian changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Atlassian free

Key DPA terms at Atlassian

What Atlassian's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Within 72 hours

“Atlassian must notify Customer without undue delay and, where feasible, no later than seventy-two (72) hours after becoming aware of a Security Incident.”
DPA, www.atlassian.com ↗
Notice of a new subprocessor: 30 days ahead

“Atlassian will provide such notice, to those emails subscribed, at least thirty (30) days before allowing any new Sub-processor to Process Customer Personal Data (the "Sub-processor Notice Period").”
DPA, www.atlassian.com ↗
Transfers outside the EU: Standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions

“The EU SCCs are hereby incorporated into this DPA by reference as follows:”

“Atlassian participates in and certifies compliance with the Data Privacy Framework.”

“Where Personal Data protected by the EU Data Protection Law is transferred, either directly or via onward transfer, to a country outside of Europe that is not subject to an adequacy decision, the following applies:”
DPA, www.atlassian.com ↗
Customer data after the contract ends: Deleted or returned when the contract ends

“Following expiration or termination of the Agreement, Atlassian must, in accordance with the Documentation, delete all Customer Personal Data.”
DPA, www.atlassian.com ↗
Audit rights: Once a year

“occur no more than once every twelve (12) months”
DPA, www.atlassian.com ↗

Documents we track for Atlassian

AI terms: checked November 9, 2026 changed November 7, 2026 www.atlassian.com ↗
DPA: checked November 9, 2026 changed November 7, 2026 www.atlassian.com ↗
Privacy policy: checked November 9, 2026 changed November 5, 2026 www.atlassian.com ↗
Subprocessor list: checked November 9, 2026 changed October 22, 2026 www.atlassian.com ↗
Terms of service: checked November 9, 2026 changed November 5, 2026 www.atlassian.com ↗

Change history

October 28, 2026 – November 7, 2026 4 minor wording edits (DPA, Privacy policy) Show Hide Reworded without changing what the documents say.
1. November 7, 2026
  
  DPA changed
  
  A download link label changed from "Download the DPA" to "Download PDF"; no substantive text changed.
2. November 5, 2026
  
  Privacy policy changed
  
  The diff removes duplicate page headers and the 'Cookies & Tracking Notice' link under 'Recommended for you' (formerly 'Related content'), and reformats EU/UK representative and contact addresses onto single lines without changing their content.
3. November 3, 2026
  
  DPA changed
  
  All changes are formatting: removed duplicate headings, merged section number/title lines onto single lines, removed repeated 'Copied! show' UI labels, reformatted a list into separate lines without changing its content, and altered page navigation/footer elements ('Related content' to 'Recommended for you', removal of a subscribe box and a Business Associate Agreement link).
4. October 28, 2026
  
  DPA changed
  
  The diff consists of heading line breaks, 'Copy link to heading' UI labels added under each FAQ question, a merge of three transfer-mechanism bullet points into one paragraph with no wording change, and footer/subscription navigation elements being reorganized; no substantive text of the DPA changed.

Tracking since September 25, 2026. Every change links to the two versions of the document it came from. All vendors' changes →

Atlassian subprocessors FAQ

How many subprocessors does Atlassian use?: Atlassian lists 46 subprocessors on its published list, including Amazon Web Services, Inc., Clumio, Inc., Databricks, Inc., Google LLC, and Microsoft Corporation and 41 more.
Where does Atlassian process customer data?: The subprocessors named by Atlassian are located in USA, EEA, Singapore, Australia, Canada, and Japan and 39 other locations, as stated on its list.
How quickly does Atlassian report a personal data breach to customers?: According to its DPA, Atlassian reports a personal data breach to customers within 72 hours: “Atlassian must notify Customer without undue delay and, where feasible, no later than seventy-two (72) hours after becoming aware of a Security Incident.”
How much notice does Atlassian give before adding a subprocessor?: Atlassian's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “Atlassian will provide such notice, to those emails subscribed, at least thirty (30) days before allowing any new Sub-processor to Process Customer Personal Data (the "Sub-processor Notice Period").”
How does Atlassian transfer personal data outside the EU?: Atlassian's DPA relies on standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions: “The EU SCCs are hereby incorporated into this DPA by reference as follows:”
When was Atlassian's subprocessor list last checked?: ClauseTrail last checked Atlassian's subprocessor list on November 9, 2026 and last saw it change on October 22, 2026. Lists are re-checked daily.
How do I find out when Atlassian adds or removes a subprocessor?: ClauseTrail monitors Atlassian's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.