New AI Data Contribution Policy: What Cloud Customers Need to Know

Atlassian; a leading global software company renowned for its enterprise collaboration, project management, and software development tools; has confirmed a major change to how customer data may be used across its cloud products. Starting…

Security News 7 min read

New AI Data Contribution Policy: What Cloud Customers Need to Know

Atlassian; a leading global software company renowned for its enterprise collaboration, project management, and software development tools; has confirmed a major change to how customer data may be used across its cloud products. Starting August 17, 2026, Atlassian says it will begin using eligible customer metadata and selected in-app data to improve apps and AI experiences, including products such as Jira, Confluence, Jira Service Management, Rovo, and other Atlassian Platform apps.

🔗 Data contribution FAQs

The change reflects a wider trend across enterprise software: AI features are becoming core product capabilities, and vendors increasingly want access to real workplace usage signals to improve automation, recommendations, search, summarization, and agentic workflows.

For Atlassian Cloud customers, this introduces an important governance question: how much control does your organization have over the data used to improve AI systems?


Why Atlassian Is Making the Change

Atlassian says the purpose of the new data contribution settings is to improve its apps and AI experiences. The company states that richer and more diverse customer usage patterns can help it deliver better AI capabilities across organizations.

This is not unique to Atlassian. Enterprise software vendors are competing to build stronger AI assistants, automated workflows, smarter search, code helpers, and collaboration agents. These systems often improve when trained or tuned using broad real-world usage patterns.

However, this creates tension between three priorities:

  • better AI features
  • customer privacy and governance
  • commercial subscription tiers

Atlassian’s new model makes that trade-off more visible.


Two Categories of Data: Metadata and In-App Data

Atlassian separates data contribution into two main categories: metadata and in-app data.

Metadata refers to de-identified signals about how products are used. This may include usage patterns and work-management signals rather than the direct text of what users create.

In-app data refers to customer-created content inside Atlassian products. Atlassian’s documentation says the initial settings apply to metadata and in-app data in Jira, Confluence, Jira Service Management, Atlassian Platform apps such as Rovo, Home, Teams, Projects, Assets, Goals, Analytics, and Administration, and certain Teamwork Graph connectors.

This distinction matters because metadata may still reveal sensitive operational patterns, while in-app content can include more direct business information such as Jira issue descriptions, Confluence pages, project documentation, incident notes, support details, workflows, and internal planning material.


Subscription Tier Determines Control

One of the most important parts of the policy is that customer control depends on the organization’s subscription level.

Atlassian states that Enterprise customers can opt out of metadata contribution. However, if an organization’s highest active plan is Free, Standard, or Premium, metadata contribution is always on and cannot be opted out.

For in-app data, Atlassian says customers can adjust available data contribution settings in Atlassian Administration. Its documentation also says every customer has the option to opt out of contributing in-app data.

This creates a practical divide:

Customer typeMetadata contributionIn-app data contribution
Free / Standard / PremiumAlways on, no opt-outConfigurable in available settings
EnterpriseCan opt outConfigurable / opt-out available
Government Cloud / Isolated CloudNot included in this changeNot included in this change
Data Center productsNot includedNot included

This means organizations on lower-cost cloud plans may have less control over metadata contribution than Enterprise customers.


Which Products Are Initially Included?

According to Atlassian’s FAQ, the initial data contribution settings apply to:

  • Jira
  • Confluence
  • Jira Service Management
  • Atlassian Platform apps, including Rovo
  • Home
  • Teams
  • Projects
  • Assets
  • Goals
  • Analytics
  • Administration
  • certain Teamwork Graph connectors

Atlassian says additional apps, such as Loom and Trello, may be added later, and customers will be notified when settings become available for additional apps.

The change does not apply to Data Center products, and Atlassian says Data Center connectors, such as the Confluence Data Center to Rovo connector, are not currently included.


Data Protection and Retention

Atlassian says contributed metadata and in-app data will be de-identified and aggregated before use. The company also says it removes direct identifiers such as names and email addresses and applies additional privacy-preserving measures.

If a customer opts out of metadata or in-app data contribution, or deletes an app or site, Atlassian says it will remove corresponding in-app data within 30 days and corresponding metadata within 90 days from datasets used to improve apps and experiences. Atlassian also says it will retrain models previously trained on that data.

Atlassian also states that it does not sell customer metadata or in-app data, and that contributed data is encrypted in transit and at rest under its standard cloud encryption practices.

These safeguards are important, but organizations with strict compliance, audit, legal, or intellectual property requirements will still need to assess whether de-identification and aggregation are sufficient for their risk model.


Why Metadata Still Matters

Metadata can sound harmless because it is not the direct content of a page, ticket, or file. But in enterprise environments, metadata can still be sensitive.

Work-management metadata may reveal:

  • project complexity
  • service delivery patterns
  • operational bottlenecks
  • team activity levels
  • incident response workflows
  • support volume
  • sprint behavior
  • business process maturity
  • organizational structure
  • delivery timelines

Even when direct identifiers are removed, patterns about how a company works may still be commercially valuable. For regulated organizations or businesses handling sensitive projects, metadata governance should not be treated as a low priority.


The Privacy Versus Price Question

The policy also raises a commercial question: is stronger data control becoming a premium feature?

Enterprise customers receive more control over metadata contribution, while Free, Standard, and Premium customers cannot opt out of metadata contribution.

This reflects a broader shift in SaaS pricing. As vendors invest heavily in AI, real-world customer usage data becomes more valuable for improving products. Customers who want more governance control may increasingly need higher-tier plans, isolated environments, customer-managed keys, or regulated cloud offerings.

For IT and procurement teams, data governance is no longer only a legal or security topic. It is becoming part of subscription planning and vendor negotiation.


What Organizations Should Do Before August 2026

The rollout date gives customers time to prepare. Organizations using Atlassian Cloud should review the change well before August 17, 2026.

Recommended actions include:

  • review current Atlassian subscription tier and available opt-out controls
  • check Atlassian Administration for data contribution settings
  • decide whether in-app data contribution should be disabled
  • document whether metadata contribution is acceptable under internal policy
  • review Jira, Confluence, and JSM content sensitivity
  • identify spaces, apps, or connectors that should be excluded where settings allow
  • assess whether Enterprise, Government Cloud, Isolated Cloud, or customer-managed keys are needed
  • update internal AI governance and data classification policies
  • inform legal, compliance, procurement, security, and data protection teams
  • review vendor contracts, DPAs, and retention expectations
  • prepare internal guidance for administrators and workspace owners

For organizations with sensitive Confluence spaces or Jira projects, this is also a good opportunity to clean up permissions, archive old content, and reduce unnecessary exposure.


Practical Admin Checklist

Before the policy takes effect, Atlassian administrators should answer these questions:

  1. Which Atlassian Cloud plan are we on?
  2. Are we able to opt out of metadata contribution?
  3. Is in-app data contribution currently enabled or disabled?
  4. Which Jira projects, Confluence spaces, and connectors contain sensitive information?
  5. Are Rovo and other Atlassian Platform apps enabled?
  6. Are Teamwork Graph connectors in use?
  7. Do our internal policies allow vendor use of de-identified and aggregated metadata?
  8. Do we need stronger contractual or technical controls?
  9. Who owns the ongoing review of these settings?
  10. How will changes be documented for audit purposes?

Final Thoughts

Atlassian’s new data contribution policy is part of a larger shift in enterprise software. AI is becoming deeply embedded into everyday collaboration platforms, and the data inside those platforms is becoming increasingly valuable for improving AI experiences.

For many organizations, the key issue is not whether AI features are useful. The issue is whether data contribution is transparent, controllable, auditable, and aligned with internal governance expectations.

The message for Atlassian Cloud customers is clear: do not wait until August 2026.

Review your plan, check your settings, understand what data may be contributed, and decide whether your current subscription tier provides enough control for your organization’s privacy, compliance, and security requirements.

Blog

Security 4 min read

FortiMail Gateway Zero-Day Under Active Exploitation

Fortinet has warned customers that a critical zero-day vulnerability in FortiMail is being actively exploited in the wild, putting internet-exposed email security gateways at immediate risk.

AI 5 min read

MI5 Warns of CGTRI Front Linked to Chinese Intelligence

The U.K.’s domestic security service, MI5, has issued an unusually direct public warning about the China General Technology Research Institute (CGTRI), alleging that the research body has strong links to China’s Ministry of State…