Confluence and the GDPR: AI training, data location and DPA

Trains on your data in part.

Yes, for metadata only: Premium always contributes de-identified, aggregated usage metadata (e.g. common search terms, Rovo prompt topics), used to train Atlassian's search models; no opt-out. Page content (in-app data) is Off unless an admin switches it On. AI providers do not train.

Vendor's wording: “Premium Metadata contribution: Is always contributed In-app data contribution: Off”

Source: support.atlassian.comData contribution settings, Default data contribution settings table, Premium rowChecked on 19 October 2026

Global: by default Atlassian apps are hosted across all Atlassian AWS regions, and data moves between regions as needed. Hosting provider is Amazon Web Services.

Vendor's wording: “By default, all Atlassian apps are hosted in the Global location, which includes all of our AWS regions.”

Source: support.atlassian.comUnderstand data residency, default locationChecked on 19 October 2026

EU hosting available.

Yes. Premium is covered: an organisation admin can pin Confluence data to Europe (Frankfurt and Dublin regions) or the US via data residency. In-app data contributions follow the setting, but de-identified aggregated data is not covered.

Vendor's wording: “You can choose whether the data is hosted in a defined geographic location, such as Europe or the US.”

Source: support.atlassian.comUnderstand data residencyChecked on 19 October 2026

DPA in the terms.

Yes. The Atlassian DPA supplements the Customer Agreement and applies automatically; EU Standard Contractual Clauses are included and effective without signing (a pre-signed copy can be downloaded).

Vendor's wording: “The EU SCCs are incorporated by reference into the DPA and are effective automatically. It is not necessary to sign them.”

Source: atlassian.comDPA FAQ, 'Why can't Atlassian use my organization's DPA?'Checked on 19 October 2026

Published.

Yes, public: https://www.atlassian.com/legal/sub-processors . 29 named third-party entries (25 distinct companies; several repeat per product) plus 15 Atlassian Group entities and 5 Government Cloud rows. AI providers: AWS Bedrock, Google Vertex AI, OpenAI, Databricks.

Vendor's wording: “Atlassian uses the third-party entities listed below”

Source: atlassian.comAtlassian Sub-processors pageChecked on 19 October 2026

On the list.

Active (Atlassian, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Atlassian'Checked on 19 October 2026

Customer can delete content in the product. After the agreement ends Atlassian deletes personal data per its documentation but may keep copies in standard backups; no fixed number of days found. Rovo AI providers keep no inputs or outputs.

Vendor's wording: “Following expiration or termination of the Agreement, Atlassian must, in accordance with the Documentation, delete all Customer Personal Data.”

Source: atlassian.comDPA, 6.2 Post TerminationChecked on 19 October 2026

At least 3 named on readable pages: ISO/IEC 27001:2022, ISO/IEC 27018 and SOC 2. The full Compliance Resource Center list is script-driven and was not readable.

Vendor's wording: “ISO/IEC 27018 establishes commonly accepted control objectives, controls and guidelines for implementing measures to protect Personally Identifiable Information”

Source: atlassian.comISO/IEC 27001:2022 pageChecked on 19 October 2026

Yes. An organisation admin can block Rovo AI features per app (including Confluence): Atlassian Administration > AI and Rovo > Access > Add app > Block access. Available on Standard, Premium and Enterprise.

Vendor's wording: “Blocking an app will disable all current and upcoming AI features for that app.”

Source: support.atlassian.comManage Rovo access, Block apps from Rovo featuresChecked on 19 October 2026