Confluence with Rovo and the GDPR: AI training, data location and DPA

Trains on your data unless you switch it off.

Yes, in de-identified form, unless an admin acts. Since 17 Aug 2026, on Free and Standard plans Atlassian uses in-app data (page titles and content, comments and similar) by default, de-identified and aggregated, to improve its apps and AI for all customers, and retrains models on it; metadata, including common Rovo Chat prompt patterns, is always contributed. Third-party AI providers never train on customer data

Source: support.atlassian.comTable 'Default data contribution settings', row 'Free or Standard'Second source: support.atlassian.comChecked on 17 October 2026

You can switch the training off.

An organisation admin must act: Atlassian Administration > Security > Data contribution, set in-app data contribution to Off (or exclude apps or spaces). Metadata contribution cannot be switched off on Standard. After opting out, in-app data leaves the datasets within 30 days and affected models are retrained

Source: support.atlassian.comIntro ('navigate to Atlassian Administration, then Security, and then Data contribution') and defaults tableSecond source: support.atlassian.comChecked on 17 October 2026

Global: data may sit in any Atlassian AWS region unless pinned; Rovo sends data outside the site to third-party model providers by default

Source: support.atlassian.comDefault location sectionSecond source: atlassian.comChecked on 17 October 2026

EU hosting available.

Yes on Standard: pin to EU (Frankfurt and Dublin) or Germany; covers Rovo chat logs and agent configuration at rest; AI processing location not confirmed

Source: support.atlassian.comPlans, regions and Rovo sectionChecked on 17 October 2026

DPA in the terms.

Yes. DPA (effective 17 Aug 2026) applies automatically with the Atlassian Customer Agreement; SCCs take effect automatically

Source: atlassian.comFAQ and section 1.5Checked on 17 October 2026

29 listed.

Public. 29 entries (25 companies) on Atlassian's list; 13 entries (11 companies) apply to Confluence Cloud, including AWS, Google Vertex AI and OpenAI; list effective 15 May 2026; 30 days' email notice

Source: atlassian.comThird-party table, 'Applicable Cloud Products'Second source: atlassian.comChecked on 18 October 2026

On the list.

Active (Atlassian, Inc.; EU-US, Swiss-US, UK Extension)

Source: dataprivacyframework.govSearch 'Atlassian'Checked on 17 October 2026

Rovo has completed SOC 2 and ISO 27001; Atlassian's AI features join its annual compliance audit. Rovo can be used in HIPAA-enabled environments within stated limits

Source: atlassian.comFAQ 'Is Rovo SOC 2 and ISO 27001 compliant?'Checked on 17 October 2026

Yes. On Standard, Rovo is on for everyone by default; an organisation admin can choose which apps have Rovo features, or block Rovo for an app

Source: support.atlassian.com'Manage Rovo access' (Atlassian Cloud: Standard, Premium, Enterprise)Checked on 17 October 2026