Navigating App Trust in the Atlassian Marketplace

The Atlassian ecosystem, products like Jira and Confluence are widely adopted, with the Atlassian Marketplace playing a critical role in providing a vast array of applications that enhance functionality and streamline workflows. However, this extensive selection also introduces a significant challenge: the complex and time-consuming process of vetting these applications for security, data handling, and compliance, especially for large enterprises and those operating in regulated industries.

Customers frequently inquire about identifying Marketplace applications that align with their internal security policies, particularly concerning data residency and control. The demand for such clarity is not merely a preference; it reflects a broader trend of increasing regulatory scrutiny and the imperative for robust data governance frameworks. As global regulations tighten and corporate risk frameworks evolve, ensuring data integrity and location becomes a fundamental requirement, not just a technical convenience. This evolving landscape underscores Atlassian's strategic move to address these fundamental enterprise concerns directly. By introducing mechanisms that simplify security approvals and guarantee data residency, Atlassian actively lowers the barriers to adoption for risk-averse organizations. This approach positions Atlassian not simply as a provider of tools, but as a trusted platform capable of supporting critical business operations, thereby expanding its reach and solidifying its presence within high-value enterprise accounts.

Introducing the 'Runs on Atlassian' Badge: Simplified Trust

The "Runs on Atlassian" badge represents a direct response to the escalating security and compliance challenges faced by organizations. This new trust signal, now prominently displayed on the Atlassian Marketplace, offers a clear indication of an application's foundational security posture.

The badge signifies that an application operates directly on Atlassian’s platform via Forge, Atlassian’s next-generation developer platform.
A primary advantage of applications bearing this badge is that their data remains within the Atlassian Cloud environment. This characteristic significantly simplifies the security approval process, as data resides in an environment that an organization likely already trusts, thereby reducing friction for IT and security teams.
Beyond merely being a Forge application, "Runs on Atlassian" apps adhere to additional stringent criteria, particularly regarding data handling and residency.
To facilitate discovery, a new filter has been integrated into the Marketplace, enabling users to easily identify applications that meet the "Runs on Atlassian" criteria.

This initiative proactively mitigates a significant barrier to adoption by addressing the complexities often associated with security approvals and the extensive evaluation of partner-hosted applications. By pre-vetting and badging applications that meet rigorous data handling standards, Atlassian effectively shifts the initial security due diligence burden from the customer to its own verified processes. This creates a more streamlined procurement and deployment experience. Furthermore, the concept that data remains within a trusted, standardized Atlassian Cloud environment serves as a powerful assurance. In a diverse cloud ecosystem, a standardized and verified environment minimizes variability, which in turn reduces perceived risk and accelerates decision-making for organizations.
undefined

What Does It Mean for an App to 'Run on Atlassian'?

While all applications bearing the "Runs on Atlassian" badge are built on Forge, it is important to understand that not all Forge applications automatically qualify for this distinction. The badge signifies an additional layer of scrutiny and adherence to specific technical and operational requirements.

To earn the "Runs on Atlassian" badge, an application must meet three core criteria. First, it must exclusively utilize Atlassian-hosted compute and storage, meaning all processing and data storage occur within Atlassian's own infrastructure. Second, the application must provide data residency in the same geographic regions as Atlassian's core applications. This is a critical requirement for organizations needing to comply with regional data protection regulations. Third, customers must retain explicit control over data egress, possessing the ability to manage and, if necessary, block any data transmission outside the Atlassian platform at any time. This capability places direct control over sensitive data in the customer's hands.

The verification process for these requirements is automated by Atlassian. Upon successful validation, the badge is automatically applied. Furthermore, applications are continuously monitored through automated systems to ensure ongoing compliance with all stated qualifications. This automated verification and continuous monitoring represent a significant advantage. The burden of demonstrating compliance, which would typically involve lengthy manual reviews by a customer's security team, is largely shifted to Atlassian's automated systems. This approach substantially reduces administrative overhead and minimizes the potential for human error in compliance checks, ultimately accelerating the time-to-value for customers. By programmatically verifying these stringent criteria, Atlassian moves beyond being solely a software vendor; it actively enables compliance for its customers, establishing itself as a partner in regulatory adherence. This builds a deeper level of trust that extends beyond mere product functionality.

undefined

Understanding the Nuances: When Apps Can't Be 'Runs on Atlassian'

It is important to recognize that due to the stringent data egress restrictions inherent in the "Runs on Atlassian" program, not every application or use case can qualify for the badge.

To qualify, applications must be capable of functioning entirely within Atlassian’s environment.
Certain categories of applications, such as integrations that are designed to exchange data between different software products, inherently require communication with external services. These applications, by their very nature, operate outside the Atlassian platform and therefore cannot be a fit for the "Runs on Atlassian" program.
Crucially, the "Runs on Atlassian" badge is not the sole indicator of trustworthiness. Many organizations require integrations, and other factors are equally vital when evaluating applications.
For a broader assessment of trust, customers should consider the "Cloud Fortified" program. This initiative recognizes partners who demonstrate exceptional commitment across various areas, including operational practices, support, reliability, and overall security posture.
Additionally, compliance certifications serve as another valuable method for evaluating applications that may not, or cannot, meet the "Runs on Atlassian" criteria.

The explicit statement that "Runs on Atlassian" is not the only trust signal underscores that no single badge can encompass every facet of an application's trustworthiness. A truly secure and reliable Atlassian ecosystem necessitates a multi-faceted evaluation approach, considering diverse dimensions of trust, from technical data handling to operational maturity and external certifications. This comprehensive perspective guides customers toward a more robust security posture. By acknowledging that not all applications, particularly integrations, can qualify for the "Runs on Atlassian" badge, Atlassian demonstrates an understanding of the diverse needs of its user base. This approach avoids creating a restrictive, "one-size-fits-all" security standard that could stifle innovation or limit essential functionalities. Instead, it provides a spectrum of trust signals, allowing customers to make informed decisions based on their specific use cases and risk appetites, fostering a more flexible and robust ecosystem.

'Runs on Atlassian' vs. 'Cloud Fortified': Clarifying Trust Signals

Both "Runs on Atlassian" and "Cloud Fortified" serve as important trust badges within the Atlassian Marketplace, yet they reflect distinct aspects of an application's security and operational posture. Understanding their differences is key to making informed decisions.

"Runs on Atlassian" primarily focuses on technical facts: it indicates that applications are hosted directly by Atlassian and will not transmit data outside the platform without explicit customer consent. This is a technical characteristic that Atlassian can programmatically verify. In contrast, "Cloud Fortified" represents a broader set of signals. It encompasses organizational behaviors and practices, including the quality of support, overall reliability, and participation in bug bounty programs. This badge signifies a partner's comprehensive investment in advanced trust practices across their entire business.

Because they address different requirements, an application might possess one badge, both, or neither. For instance, an application could be "Runs on Atlassian" due to its technical architecture but not "Cloud Fortified" if the developer has not yet met the broader operational criteria. Conversely, a complex integration might be "Cloud Fortified" due to its robust support and reliability, even if it cannot be "Runs on Atlassian" because it necessitates external data exchange.

Feature	Runs on Atlassian	Cloud Fortified
Primary Focus	Technical data handling and residency	Operational practices, reliability, support, security
Verification	Programmatic, automated by Atlassian	Broader set of signals, organizational behaviors
Data Egress	Data stays on-platform, customer controls egress	No specific data egress requirements
Scope	Specific technical compliance for data security	Holistic partner commitment to advanced trust
App Type Fit	Apps functioning entirely within Atlassian's env.	Broader range of apps, including integrations

The fact that an application might hold one badge, or both, illustrates that these badges are not mutually exclusive; rather, they are complementary layers of trust. "Runs on Atlassian" provides a foundational assurance regarding technical data security, while "Cloud Fortified" adds a layer of operational and organizational reliability. For maximum assurance, organizations may seek applications that possess both, indicating a developer's commitment to both technical integrity and robust business practices, thereby promoting a layered security strategy. By clearly delineating the distinct value propositions of each badge, Atlassian empowers customers to conduct more nuanced and informed risk assessments. This sophistication helps organizations balance their security needs with functional requirements, avoiding unnecessary delays or rejections of valuable applications.

The Tangible Advantages of 'Runs on Atlassian' for Your Business

Prioritizing and utilizing applications with the "Runs on Atlassian" badge offers clear, practical benefits for organizations, enhancing efficiency, bolstering security, and streamlining strategic decision-making.

Reduced Evaluation Time: The badge significantly cuts down the time and effort typically required to research and evaluate individual applications. The standardized environment and Atlassian's pre-verification simplify the entire process.
Enhanced Security Posture: Applications bearing this badge operate on infrastructure subject to Atlassian’s robust security controls, which inherently reduces complexity and mitigates risk for the customer.
Operational Efficiency for Administrators: IT and security teams spend considerably less time on tedious security questionnaires and back-and-forth reviews, freeing them to focus on more strategic and impactful work.
Peace of Mind: The badge offers reassurance by ensuring that sensitive data remains securely within Atlassian’s trusted environment, addressing a paramount concern for enterprises, particularly those in regulated industries.
Confidence in Security: Atlassian's direct verification of the badge requirements provides an independent and reliable assurance of accuracy and compliance.
Streamlined Decision-Making: Customers can quickly and confidently identify applications that meet their stringent security and compliance needs, thereby accelerating the adoption of valuable solutions across their organization.

undefined

"At Appsvio, security is a top priority, and having our apps in the Runs on Atlassian program is a key part of our strategy. This investment ensures a secure, reliable, and high-performing ecosystem that protects customer data—something increasingly vital for companies of all sizes". This emphasis on reducing evaluation time and minimizing security questionnaire burdens clearly indicates a strategic shift where Atlassian assumes a substantial portion of the security vetting responsibility for its customers. This represents a fundamental change in the trust model, allowing customers to leverage Atlassian's expertise and infrastructure for their application security requirements, rather than duplicating efforts internally. By streamlining the application evaluation process, the "Runs on Atlassian" program directly contributes to faster adoption of new tools and functionalities, thereby accelerating digital transformation initiatives within organizations. The ability to quickly and confidently deploy new applications means teams can be more agile, innovative, and productive, unhindered by lengthy security reviews.

Real-World Impact: Streamlining Security and Compliance

The practical benefits of the "Runs on Atlassian" badge are best illustrated through real-world scenarios, demonstrating its effectiveness in solving concrete business problems for security-conscious organizations.

Consider the example of a project manager at a bank tasked with finding a time-tracking application. For a financial institution, security is a paramount concern, and it is critical that sensitive data does not leave Atlassian’s environment. In the Marketplace, the "Runs on Atlassian" badge instantly highlights applications that meet the bank’s strict data residency and security requirements. This eliminates the need for extensive, often protracted, security reviews by the bank's security team, preventing delays in deployment. A process that previously involved lengthy, back-and-forth security assessments is now streamlined and stress-free.

Julian Wolf, Technical Coordinator at Seibert Media, has observed similar scenarios with their security-conscious customers, particularly concerning their draw.io application. "Our customers visualize business-critical data with draw.io. Especially for our customers in regulated industries, the key question in their app assessment has always been, What security practices are in place to protect that critical information? For us, it was clear we had to invest in compliance with the necessary platform changes, such as the migration to Forge and qualifying for Runs on Atlassian," Wolf stated. He further noted, "Now, customers can verify draw.io’s commitment to strict egress rules through an easily understandable badge. The new program allows us to give customers the greatest possible control over the path their data takes". This highlights how the badge empowers customers to easily verify adherence to strict egress rules, providing greater control over their data's path.

For enterprise customers, particularly those in regulated industries or regions, data security and residency are not merely preferences but critical mandates. The bank example and the draw.io testimonial underscore how the badge functions as a pre-approved stamp for these essential criteria, effectively serving as a "compliance shortcut." This significantly reduces the time and resources traditionally consumed by manual security assessments, allowing these organizations to adopt new tools more rapidly while maintaining strict regulatory adherence. Furthermore, the willingness of companies like Appsvio and Seibert Media to invest in qualifying for "Runs on Atlassian" demonstrates that the badge is not just a customer benefit; it also incentivizes developers to prioritize security and compliance in their application development. This fosters a "security-first" culture within the Atlassian Marketplace ecosystem, elevating the overall standard for trust and reliability across the platform.

Ready to Enhance Your Atlassian Ecosystem?

The "Runs on Atlassian" badge is now live on the Atlassian Marketplace, offering a clear path to identifying applications that meet stringent security and data residency requirements. We encourage you to explore the dedicated collection of "Runs on Atlassian" applications and consider joining upcoming Atlassian Community Events (ACE) to delve deeper into this vital topic.

Interested in learning more? Contact Atlas Bench to book a complimentary consultation with our Certified Atlassian Experts.

Explore the Runs on Atlassian Collection

Atlas Bench is an Atlassian Platinum Solution Partner with deep Cloud Specialization, helping Data Center customers move beyond migration and fully transform on the Atlassian Cloud Platform. We deliver Atlassian’s System of Work end to end through four collections: Strategy, Teamwork, Service, and Software, connecting planning to execution, aligning teams around outcomes, modernizing service delivery, and accelerating software development.

We are also recognized as an Atlassian World Class Software Development Partner of the Year (Americas), and we bring AI leadership to every engagement. By leveraging Rovo for automation and purpose built agents, we reduce manual work, unlock knowledge across tools, and speed up decision making so organizations realize measurable value faster in cloud.