What is the Atlassian Enterprise Certified program?

While all third-party apps must meet Atlassian’s baseline security requirements to be listed on Marketplace, the Atlassian Enterprise Certified (AEC) program identifies apps built to meet common enterprise customer needs.

The program combines automated vulnerability scans, independent compliance audits, and expert manual reviews to conduct security and technical evaluations on your behalf.

This makes it easier for security, legal, and procurement teams to fast-track reviews and deploy mission-critical tools with confidence.

Spot an Atlassian Enterprise Certified Marketplace app

Marketplace apps that meet the Atlassian Enterprise Certified requirements will be given a badge in their listing. When searching on Marketplace, you can also filter by the badge, to make sure only apps that meet the program's requirements are shown.

What’s required to earn the Atlassian Enterprise Certified badge?

To earn and maintain the Atlassian Enterprise Certified badge, Marketplace apps must be built on Atlassian’s Forge platform and satisfy rigorous requirements across four core enterprise pillars:

Advanced security and vulnerability management

Mandatory annual third-party penetration tests (CREST-accredited)
Active participation in Atlassian’s Bug Bounty program
Automated vulnerability scanning
Strict least-privilege data access
Full-disk encryption at rest for any data stored outside Atlassian infrastructure

Enterprise privacy and compliance

Independently verified SOC 2 Type 2 or ISO 27001 certification
Full Data Residency support (data pinning and migration)
Documented data retention and deletion lifecycles
Public Trust Center and Privacy Policy

Operational reliability & dedicated support

Real-time uptime visibility via a public Statuspage
Coordinated incident response workflows directly with Atlassian engineering
Guaranteed 24-hour response SLA (5 days/week) for critical support issues

Accessibility & responsible AI governance

A publicly available Voluntary Product Accessibility Template (VPAT) verifying accessibility standards compliance
AI usage policies (where applicable) governing data handling, model training, and privacy controls

For the full breakdown of validation checks and technical criteria, explore the Atlassian Enterprise Certified program developer documentation

Available Marketplace certifications

Marketplace apps can earn different badges depending on the requirements they meet. Alongside the Atlassian Enterprise Certified program, there’s also the Runs on Atlassian program.

It’s possible for an app to earn both an Atlassian Enterprise Certified and Runs on Atlassian badge.

To help you choose the right Marketplace app for your organization and governance needs, here's what each certification includes:

	Atlassian Enterprise Certified	Runs on Atlassian
What it signals	Holistic enterprise trust & operational rigor with verification of: Trust, security, compliance Support SLAs Accessibility and AI governance	Cloud-native architecture & data boundary guarantees where the app runs and how its data is stored.
Hosting and infrastructure	Built on Forge May include verified, secure partner infrastructure/remote data egress, if compliant with strict encryption and data residency standards.	Hosted entirely on Atlassian’s cloud infrastructure. Forge compute and storage with no third-party hosting.
Data egress	Permitted with strict encryption, public architecture diagrams, and data residency controls.	No data egress by default. Customers can control external data egress (for example, analytics and logs) via admin controls.
Audits and governance	Requires external compliance audits (SOC 2 Type 2 / ISO 27001), annual penetration tests, Bug Bounty, and VPAT.	Programmatically verified based on the marketplace app's architectural footprint on Forge.

Still need help?

The Atlassian Community is here for you.

Ask the Community