Sovereignty: what is possible, what is not.
Atlassian Cloud is an online service operated by Atlassian. That sentence sets the limits of the exercise.
What is possible. Depending on the products and the plans, it is possible in particular to:
01Choose a data residency region
02Obtain the vendor's security attestations
05Strengthen authentication and access policies
06Take certain projects out of the active instance and keep them in your own infrastructure
Our solution Aquarius can, for example, extract and archive sensitive Jira projects into a self-contained archive.
What is not. Atlassian Cloud is not a Cloud run by the host of your choice.
Data whose constraints require it to stay in a specific environment therefore cannot simply be transferred into Atlassian Cloud.
On some projects, the right answer may be to keep a scope outside the Cloud for a time, or to choose another solution for certain data. We have already kept two Confluence spaces in-house, by the client's strategic choice, alongside a migrated scope.
The migration therefore has to be decided scope by scope, not as a single monolithic move for the whole organisation.
Data residency is offered in the European Union, in Frankfurt and Dublin, for Jira, Confluence and Jira Service Management on the Standard, Premium and Enterprise plans. Atlassian publishes its SOC 2 and ISO 27001 attestations.
Legal sovereignty is about the applicable law. Operational sovereignty is about something else: continuing to operate without your supplier.
The real test of sovereignty is not going in with a supplier. It is getting out.