Does Atlassian Cloud (Jira, Confluence and Rovo) keep data in Australia?
Some data can be kept in Australia. Jira and Confluence data can be pinned to Australia (Sydney) on paid plans, but user accounts, analytics and logs are global, and Rovo AI processing is sent outside Australia by default.
Atlassian · Work management · Plans covered: Standard, Premium, Enterprise · Last checked
What Atlassian says
| Claim | Status | Vendor's words | Source | Last checked |
|---|---|---|---|---|
| Storage at rest | Partly | AU: In-scope data is hosted within the Sydney AWS region Note: Atlassian calls these locations "realms". The support page lists "Australia" as "Consists of Australia (Sydney) region". Pinning is opt-in: "By default, all Atlassian apps are hosted in the Global location", where Atlassian moves in-scope data between AWS regions. An organisation admin requests the move under Atlassian Administration > Data management > Data residency; a move can mean up to 24 hours of downtime. Pinnable data covers Jira issues, comments, attachments and project configuration, and Confluence pages, blogs, comments, attachments, whiteboards and databases. Rovo chat session logs and agent configuration follow the residency of Jira (or Confluence if there is no Jira). New backups from Atlassian Backup and Restore follow the pinned location from 28 April 2026. | developer.atlassian.com | |
| Processing (incl. AI inference) | Not in Australia | By default, when using Rovo, data is transferred outside of the current site to third party LLM providers (e.g., OpenAI) in order to generate a response. Note: Where Jira and Confluence process pinned data outside AI features is not published; residency covers data at rest. For AI, Atlassian's sub-processor list gives OpenAI's location of processing as "USA", Google Vertex AI as "USA, EEA (Belgium, Netherlands, Finland), Singapore, Taiwan", and AWS Bedrock as a list of countries that includes Australia, with no commitment that an Australian customer's requests stay there. Cloud Enterprise customers can ask for Atlassian-hosted LLMs only, so that "no customer data leaves Atlassian’s Cloud boundary for LLM processing", but that page also says "Atlassian-hosted LLMs run on Atlassian-managed infrastructure across multiple global regions." No Australian AI processing option is published. | www.atlassian.com | |
| Support access | Not in Australia | The Atlassian Group companies below may also act as Sub-processors to the extent that these Atlassian Group companies process Customer Personal Data when providing technical and operational support to customers. Note: The listed group companies are in the Netherlands, Canada, France, Germany, India, Japan, Korea, New Zealand, the Philippines, Poland, Singapore, Australia, the UK, the US and Türkiye. Outsourced customer-service and technical-support sub-processors for Jira and Confluence are listed in Brazil, Mexico, Bulgaria, Poland, the United States and Romania. No option to limit support access to Australia is published. | www.atlassian.com | |
| Plan required | Paid option | Data residency is available for Standard, Premium, and Enterprise cloud subscriptions. Note: Not available on Free plans. Atlassian says it is not increasing the price of Standard or Premium for data residency. The Atlassian-hosted LLMs option for Rovo is Cloud Enterprise only, by request. Atlassian Government Cloud is "Not available as all data is resident in the U.S region." | www.atlassian.com | |
| Exclusions | Partly | We store user account information, such as your name, email address, and avatar, in a central identity service with globally distributed replicas. Note: The "Can't be pinned" column also lists, for Jira, connected DevOps data (commits, branches, pull requests, builds, deployments) and app analytics; for Confluence, permission and restriction configuration data and space keys; for Rovo, app analytics and Studio-built Forge app code; and, at platform level, data in transit (up to 30 days), app, audit and operational logs, user analytics, Atlassian Guard audit log events, and third-party app integration data. Marketplace apps have their own residency, which Atlassian says to confirm with each app vendor. | support.atlassian.com | |
| IRAP status | Yes, in Australia | Atlassian has successfully attained the PROTECTED classification under the IRAP framework for its products, including Jira, Confluence, and Jira Service Management Cloud. Note: The page also says "the IRAP Assessment Report is not a certification" and lists addendum letters for newer ISM releases, the latest dated May 2026. Rovo is not named in the scope sentence. The report and letters (on customertrust.atlassian.com, sign-in needed) were not read, so the exact scope, ISM version and whether Rovo or Atlassian Intelligence are covered are not confirmed. | www.atlassian.com |
Why it matters
General information, not a compliance ruling.
- APP 8
- APP 8: sending personal information overseas, including remote access, can be a cross-border disclosure → see storage, processing, support access. Relies on: Storage at rest, Processing (incl. AI inference), Support access
- ISM-1572
- ISM-1572: contract must record processing and storage regions → see storage + processing. Relies on: Storage at rest, Processing (incl. AI inference)
- APRA CPS 230
- CPS 230: offshoring with a material service provider must be assessed and notified to APRA → see storage, processing, support access, exclusions. Relies on: Storage at rest, Processing (incl. AI inference), Support access, Exclusions
- OVIC IPP 9
- IPP 9 (Victoria): personal information may leave Victoria only in set circumstances → see storage, processing, support access. Relies on: Storage at rest, Processing (incl. AI inference), Support access
Changelog
No changes recorded yet.