Compliance FAQ

Based on roll-out, or in some cases acquisition, the Products in our ISO27001 and ISO27018 scope vary. For the most up to date Products and their associated compliance program, see the Atlassian Compliance page.

We post all current compliance reports to our Compliance Resource Center.

For PCI, we generally receive updated certification in September of each year and the certificate is valid for 1 year. Our PCI certification is only related to Atlassian processing credit cards for payments. We do not provide assurance for credit cards that our customers elect to store in our products. If that is your use case, you should review our SOC2 report to determine if the controls are satisfactory for you.

SOC2 Type 2 audits are a review of performance of controls over a period of time. Once the audit period is over, the report is prepared and made available to customers. Atlassian issues SOC2 reports covering a 12-month period (October 1 through September 30). The reports are applicable for the following 12 months, when we perform the next audits.

There are many factors that impact the release of new reports, but our external audits typically occur in November and refreshed reports are usually available by end of December each year. We also issue a 3-month bridge letter in January/February of each year that extends the coverage period through the end of January.

All SOC2 reports (and the bridge letter) can be downloaded on the Compliance Resource Center.

Based on Atlassian’s full-year of coverage within our SOC2 report cycles, we can provide a bridge letter or gap letter. This document can be downloaded under the same click-through NDA as the SOC2 report on our Compliance Resource Center - SOC 2.