Data Residency in EU

[Marcel Semmler]

Hi guys,

is there something on the roadmap of Atlassian that enables customers to have all their data of the cloud solution hosted in EU locations (incl. user identity data).
With the Schrems-II this is becoming a pre-requisite for European customers in order to remain compliant.

Currently, I can only see that data-residency can be configured only for non user-identity data and only in Enterprise package.

Thanks for your help.

Best,
M

[RJ Gazarek · Accepted solution]

Hi Everyone!  Sorry for finding this post so late, but happy to help as much as I can.  I'm a Product Manager in our Cloud team, and my responsibility is around data management, of which, Data Residency is one of my primary focuses.

First up, we have a private group discussion going on right now about many topics related to security & compliance.  Click this link, request to join, and we'll get you in ASAP.  There is a post there where I'm collecting continued feedback and having open company, no bullshit discussions on data residency with existing customers: 

https://community.atlassian.com/t5/Cloud-Security-Compliance/gh-p/cloud-security-compliance

Second, with respect to this post directly.  We do offer data residency today in our Enterprise cloud edition.  We are currently heavily investigating, and reaching a decision soon, about if/how/when we would offer this to standard and/or premium editions of cloud.

Regarding identity data.  We do not currently have profile data on our roadmap, but it is something we are also heavily investigating as we collect more feedback from customers, as well as what our peers in the tech industry are currently doing.  In general, we find that when we talk about personal data (PD), there are two sides to this - there is PD you create and store in Atlassian products (this is of course covered by our current data residency offering where applicable, e.g. you add a customer's name and email address to a jira issue).  Then there is your profile data (name & email) associated with your Atlassian account.  When we've talked to customers, the hard requirement is on the first piece, which we've covered.  There is far less concern, even given the Schrems II case about the profile account data (name & email), as we are currently meeting all of the legal requirements of Atlassian today.  With that said, we understand that if the need continues to rise, we'll continue to evaluate when/how we should bring this onto our roadmap.  

I'd love to continue this conversation in our closed group, so please come on over and say hi!  Everyone's feedback on this, from all around the world, all industries, and companies of all size are extremely welcomed!

[Kesha Thill · Accepted solution]

@Marcel Semmler @Jack Brickey @Nic Brough -Adaptavist- Hi all! To follow up on RJ's answer above, we also recently announced that data residency will be included in our Standard and Premium cloud plans later this year, in addition to our Enterprise plan! To learn more and sign up for updates, visit our page here. 

To see what else we're working (like additional realms and functionality) related to data residency, visit our cloud roadmap here.

[Jack Brickey]

Thanks for sharing @Kesha Thill !

[Jack Brickey · Accepted solution]

If memory serves this is a feature of Premium (or Enterprise). This page might be useful to you - manage-data-residency 

[Jack Brickey]

just confirmed you must have Enterprise to be able to specify - cloud-data-hosting-regions 

[Marcel Semmler]

Thanks Jack, that is also what I have found.
What bugs me is that the data residency for GDPR relevant data (Data in transit, User account information data, User analytics) cannot be configured and currently always sits in the US, which is not really ideal looking at the Schrems-II court decision for EU in Summer last year.

I thought that maybe Jira/Atlassian has a plan on the roadmap to allow complete data residency within the EU. A lot of other Software-as-a-Service Providers for other services, I have talked to, are planning to release a EU data residency usually in the first half 2021 in order to comply to the new regulations.

[Jack Brickey]

two more things to share...

• https://www.atlassian.com/trust 
• Atlassian Support- contact them and inquire about your concerns

[Nic Brough -Adaptavist-]

If you do get an answer from the support call, please share what you can, there are other people finding your question who would appreciate the answer!

[Marcel Semmler]

Thanks guys. I contacted the support and share the answer here.

[Marcel Semmler]

As promised the two answers from the support:

Privacy and Security are among the highest priorities at Atlassian, and we’re analyzing developments after the most recent Schrems decision.

To address the court’s decision, we currently provide a pre-signed DPA that includes a full copy of the Standard Contractual Clauses (SCCs). Additionally, older versions of our DPA include the SCCs as a fallback data transfer mechanism in the event of invalidation of the Privacy Shield. If your organization wishes to update to the latest DPA, please follow the instructions here

To the extent we have ongoing obligations under our Privacy Shield Certification, we will continue to honor them.

We’re committed to protecting our customers’ data and keeping your trust by ensuring data is protected with the utmost care and in compliance with applicable data privacy laws and requirements, including in circumstances where legal standards evolve.

For more information see International Data Transfers.

For more information around security and data encryption, see: Product Security.

Also, Atlassian will optimize where customer data is located based on how it's accessed around the world. For example, if the majority of your users access your cloud site from Europe, then their data will be migrated to Europe.