The overall trust score of 50 reflects a conditional recommendation for Confluence. While compliance is strong (35/35 for SOC2, GDPR, ISO 27001) and security features are robust, significant deductions stem from the legal/IP assessment (35/100). This low legal score is primarily due to undisclosed AI training data policies, unclear IP ownership of user content, and opaque data retention timelines. The financial health of Atlassian is strong (83/100), and community sentiment is generally positive (65/100), but these do not offset the critical legal and data transparency risks. To improve the score, Atlassian must provide explicit, publicly available policies on AI training data opt-out, IP ownership, and a comprehensive Service Level Agreement.
Enterprise Verdict
Negotiate DPA and data residency terms before signing
Risk Assessment
Seven-category enterprise risk analysis derived from community and vendor signals. Each card shows the evidence tier and the underlying finding.
The vendor's public documentation does not explicitly state whether customer data is excluded from AI model training, posing a high data privacy risk. This must be treated as implicit consent unless a written opt-out DPA is provided.
Opaque data retention policies create a compliance gap for GDPR/CCPA-regulated entities, as specific data deletion timelines are not publicly committed. A written DPA with a specific retention schedule is required.
SLA terms are not publicly disclosed. Uptime commitments require direct vendor contract negotiation, which is a HIGH RISK signal for enterprise procurement teams. Absence of a public SLA page means no recourse for downtime without a signed MSA.
Low public enterprise integration score indicates limited documented enterprise controls. Verify SSO, audit logging, and data export capabilities before procurement. The deep integration with the Atlassian ecosystem also contributes to potential lock-in.
AI training data policy is not explicitly disclosed, and IP ownership of AI-generated outputs is unclear. This lack of transparency is a critical concern for enterprises using AI features with proprietary data.
Enterprises should negotiate fixed-rate contracts and monitor pricing changes for overage risks.
Insufficient public community reviews to verify support quality. Standard support channels (email/documentation) are assumed.
Due Diligence Alerts
Priority reviews, recommended inquiries, and verified strengths — based on 56+ community data points
No critical or high-severity alerts this week
Our analysis found no items requiring immediate due diligence action for this reporting period. This does not mean zero risk — check the Risk Assessment section above for the full seven-category breakdown.
Security & Compliance
Data Security
Security Features
IT Hardening Guide
Deployment Checklist
Legal & IP Risk
IP Ownership
Liability & Indemnification
Exit Terms
ToS Red Flags
Atlassian may modify the Agreement, with changes effective during a current subscription term if required by law or for product updates. Customers may terminate as exclusive remedy.
The privacy policy states information is used for development and improvement, including 'fine-tuning of machine learning and artificial intelligence models,' without a clear opt-out for customer content.
Customers are prohibited from using products to develop similar or competing services, or reverse engineering, limiting competitive analysis and internal development.
While data retrieval is mentioned, explicit guarantees for data portability in standard, machine-readable formats upon termination are not clearly stated, increasing vendor lock-in risk.
Customer bears full responsibility for user actions and third-party integrations, including data access, which requires robust internal governance.
Data & Migration Lock-in Risk
- Deep integration with Atlassian ecosystem (Jira, Bitbucket)
- Proprietary content formats and macros
- Reliance on Confluence as a single source of truth for knowledge management
- Lack of explicit data portability guarantees in standard formats
Enterprise Contract Intelligence
DPA availability, data residency, and contract risk signals for procurement teams
A Data Processing Addendum (DPA) is publicly available. It supplements the Atlassian Customer Agreement and outlines roles of parties (Controller/Processor), scope of processing, and data transfer provisions including Standard Contractual Clauses (SCCs). However, it does not explicitly detail AI training data opt-out or specific data retention periods.
Atlassian offers data residency options, allowing customers to specify data storage locations in the US or EU. This helps address GDPR and other regional compliance requirements. However, the default region is US, and specific details on cross-border transfer mechanisms beyond SCCs are not fully elaborated in public documentation.
⚠ 5 contract risk flags — click to review
The contract risk for Confluence is high due to several clauses in the Atlassian Customer Agreement. These include unilateral modification rights, automatic renewal, and a lack of explicit data portability guarantees upon termination. The most significant area warranting further due diligence is the undisclosed policy on AI training data, which could lead to vendor lock-in and data privacy issues. Procurement teams must negotiate a custom DPA and MSA to mitigate these risks.
Community Evidence
Sentiment analysis and recurring issues from developer & enterprise community signals this week.
Recurring Issues
Enterprise Impact: Reported by community on GitHub with 6 comments.
Enterprise Impact: Reported by community on GitHub with 3 comments.
Enterprise Impact: Reported by community on GitHub with 3 comments.
Enterprise Impact: Reported by community on GitHub with 3 comments.
Source Highlights This Week
Specific signals from GitHub, Hacker News, and Reddit — what the community is actually saying
Analysis Pending
Community signals collected this week. Analysis and synthesis will be available in the next report update.
Financial Impact Panel
Cost intelligence and pricing signals for enterprise procurement decisions
Pricing data from public sources — enterprise rates differ. Verify with vendor.
TCO Calculator
Pricing Not Available
Enterprise pricing information could not be obtained for this vendor. This may be due to custom/private pricing models or limited publicly available data.
Independent analysis — signals aggregated from GitHub, Reddit, HN, Stack Overflow, Twitter/X, G2 & Capterra. Not affiliated with any vendor. Corrections?
Download PDF Report
Create a free account to download the full enterprise audit PDF.
Sign up — it's free →Already have an account? Log in