Atlassian doesn’t ask Marketplace Partners to hold both SOC 2 and ISO 27001. It asks for one of them, a SOC 2 Type 2 report or an ISO/IEC 27001:2022 certificate, and only once you reach Gold or Platinum in the Marketplace Partner Program or go after the new Atlassian Enterprise Certified badge. What trips most partners up is timing. Atlassian reviews partner levels every July, your evidence has to exist before July 1, and you can’t rush a SOC 2 Type 2 report.
Below you’ll find what each program requires, which standard to pick, how to scope the audit around your app, the controls auditors push hardest on, and a timeline that gets you certified before your next review.
Why Atlassian Marketplace Partners Now Need SOC 2 or ISO 27001
For years, a Marketplace app’s security story was really Atlassian’s story. Customers trusted Jira and Confluence, and the apps came along for the ride. Enterprise buyers don’t see it that way anymore, and neither does Atlassian.
Enterprise Procurement and Vendor Security Reviews of Marketplace Apps
Enterprise security teams treat a Marketplace app like any other vendor. Signing off on Jira doesn’t mean signing off on the reporting or time-tracking app installed on top of it, especially if that app sends data to servers you run. Most vendor questionnaires open by asking for a SOC 2 report or an ISO 27001 certificate. If you don’t have one, your team fills in the whole questionnaire by hand while the deal sits in procurement.
SOC 2, ISO 27K and Partner Trust Center as Marketplace Trust Signals
Compliance now shows up on the Marketplace itself. SOC 2, ISO 27K and Partner Trust Center are trust signals on partner profiles, and customers can filter apps by them. Once a buyer ticks “SOC 2” in that filter, apps from vendors without a report drop out of their results, however good they are.
The Retirement of Cloud Fortified and Cloud Security Participant
In RFC-124, published in January 2026, Atlassian proposed retiring Cloud Fortified and Cloud Security Participant and cutting its trust programs down to two. Runs on Atlassian covers where an app runs and stores its data. The second program covers how an app is built and operated, and it has since launched as Atlassian Enterprise Certified. Bug bounty participation and similar investments still show up as separate trust signals on the listing. In practice, the badge that used to mean “enterprise ready” now needs third-party compliance evidence behind it, where Atlassian’s own checks used to be enough.
Which Atlassian Programs Require SOC 2 Type 2 or ISO 27001:2022
What you need depends on your Marketplace Partner Program level, and on whether you want the Enterprise Certified badge for a particular app. Here’s how they compare, based on Atlassian’s published program requirements.
| Program | Annual sales threshold | SOC 2 / ISO 27001 | Bug bounty | Support response | Trust Center |
|---|---|---|---|---|---|
| Silver | $150K cloud | Not required | Most-installed public paid cloud app | Under 48 hours | Not required |
| Gold | $750K cloud, plus $10K from Forge | SOC 2 Type 2 or ISO 27001:2022 audit scheduled (FY26 rule) | All public paid cloud apps over 100 installs | Under 24 hours | Not required |
| Platinum | $3M cloud, plus $150K from Forge | SOC 2 Type 2 or ISO 27001:2022 held | All public paid cloud apps | Under 24 hours | Third-party validated |
| Enterprise Certified (per app) | None | Independently verified SOC 2 Type 2 or ISO 27001 | Active participation | 24 hours for critical issues | Public Trust Center |
Silver Marketplace Partners
Silver has no SOC 2 or ISO 27001 requirement. You need $150K a year in cloud sales, support responses under 48 hours, and your most-installed public paid cloud app enrolled in the bug bounty program. If you expect to move up in the next year or two, start the compliance work now. The Gold requirement applies at the same review where your revenue first qualifies you, so you won’t get a grace year.
Gold Marketplace Partners
For fiscal year 2026, Gold partners only needed a SOC 2 Type 2 or ISO 27001:2022 audit scheduled. It didn’t have to be finished. That was a one-year transition, so expect future reviews to ask for the actual report or certificate. Check the current rule with your Partner Manager before you set a timeline.
Platinum Marketplace Partners
Platinum partners have to hold a current SOC 2 Type 2 report or ISO 27001:2022 certificate and run a Trust Center validated by a third party. Bug bounty coverage also widens to every public paid cloud app you sell. If your report expires or your certificate lapses, your tier is at risk at the next review.
Atlassian Enterprise Certified Apps
Enterprise Certified is a badge for individual apps, separate from your partner tier, and any Forge cloud app can apply. Atlassian scheduled onboarding to start in Q3 2026. On top of independently verified SOC 2 Type 2 or ISO 27001 certification, it asks for an annual penetration test from a CREST-accredited tester and active bug bounty participation. You’ll also need full data residency support, documented data retention and deletion, a public status page, a public Trust Center, a VPAT covering accessibility, and AI usage policies if your app uses AI. It’s the hardest badge on the Marketplace to earn, and it’s the one enterprise buyers will filter for.
How the Annual July Partner Program Review Checks Compliance
Atlassian reviews partner levels automatically every July. Sales, support and Paid via Atlassian activity count from July 1 of the previous year to June 30 of the current one, and security and trust submissions only count if you make them before July 1. Atlassian does contact partners who look likely to miss a requirement. If that warning arrives in May, though, you won’t have time to produce a SOC 2 Type 2 report.
Important: Atlassian can change, add or drop program requirements at its discretion. Treat the table above as a snapshot, and recheck the Marketplace Partner Program page each spring before you book an audit date.
SOC 2 or ISO 27001: Choosing the Right Standard as a Marketplace Partner
Atlassian accepts either standard, so the decision comes down to who buys your app. Our guide to the key differences between ISO 27001 and SOC 2 covers the frameworks in general. Here we’ll stick to what matters for Marketplace vendors.
Matching the Standard to Your Customer Base (US vs EU and Global Buyers)
US enterprise buyers usually ask for SOC 2. ISO 27001 carries more weight in Europe and the rest of the world, and plenty of Marketplace partners are based in Germany, Poland, and elsewhere in the EU, with most of their sales in German-speaking markets. yasoon, a Platinum partner, went for ISO 27001 first for exactly that reason, since most of its customers were German. Look at your top 20 accounts and the last 10 security questionnaires you answered. Whatever they asked for is usually your answer.
Why SOC 2 Type 1 Is Not Enough for Gold and Platinum
A SOC 2 Type 1 report checks that your controls are designed properly at one point in time. A Type 2 report checks that they actually worked over an observation period, usually three to twelve months. Atlassian asks for Type 2 everywhere it asks for SOC 2, so a Type 1 report won’t meet the requirement on its own. It can still help your sales team while the Type 2 window runs.
ISO 27001:2022 Transition Requirements
Atlassian asks for the 2022 edition by name. Under the International Accreditation Forum’s transition rules, every ISO 27001:2013 certificate expired or was withdrawn by October 31, 2025. If you missed that date, you no longer hold a valid certificate. You’ll need a full initial certification against ISO/IEC 27001:2022, which costs more and takes longer than the transition audit would have.
When Marketplace Partners Should Pursue Both
Go for both when your revenue splits fairly evenly between US and European enterprise buyers, or when big customers keep asking for the one you don’t have. The two standards share most of their controls. Design your program with both in mind from the start, and the second one costs far less than the first. If you’re a small team chasing Gold, pick one, get it done before July, and add the other later.
Scoping Your Audit as an Atlassian App Vendor
Scope is where Marketplace partners most often overspend or show up underprepared. Your app’s architecture decides what the auditor needs to see.
Forge vs Connect: How App Architecture Changes Audit Scope
A Connect app runs on your own infrastructure and talks to Atlassian over the network, which puts your hosting, databases, networking, and deployment pipeline in scope. A Forge app runs on Atlassian’s platform, so most of the hosting layer drops out of your audit. Atlassian stopped accepting new Connect apps in September 2025, and Connect support ends on January 31, 2027. If you’re mid-migration, scope the audit around the Forge version you’ll be running when the observation period ends.
Runs on Atlassian Apps and Atlassian’s Shared Responsibility Model
Runs on Atlassian apps run entirely on Atlassian infrastructure, keep customer data there and support data residency. That shrinks your technical scope a lot, but it doesn’t make it go away. You still have to control your own company and prove it: your people, your code, who can get into the Atlassian developer console, and how you handle incidents.
Insider Note: The most common scoping mistake we see is app vendors assuming Atlassian’s own SOC 2 report covers their app. It covers Atlassian’s platform. Auditors will still test your access reviews, onboarding and offboarding, change management, vendor management and security training, even if every line of your app runs on Forge.
Forge Remote and Partner-Hosted Infrastructure
Lots of Forge apps use Forge Remote to call a backend the partner hosts, usually for heavy processing, AI features, or integrations with other systems. Everything behind that remote endpoint comes back into scope, including the cloud account, databases, logs, and the secrets you use to authenticate with Atlassian. Map every data flow that leaves Atlassian before you talk to an auditor. Those flows decide your scope, and they decide your data residency answers too.
Which Apps, Teams and Systems to Include in Scope
Start with the apps that bring in most of your cloud revenue, plus every app your bug bounty obligations cover. Include the engineering, support, and ops people who can reach production or customer data, along with the systems they use to do it: source control, CI/CD, cloud accounts, and the Atlassian developer console. You’re allowed to leave a paid app out of scope, but expect enterprise buyers to ask why theirs isn’t in your report.
Controls Auditors Focus On for Marketplace Apps
SOC 2 and ISO 27001 cover your whole organization, but for Marketplace vendors a few control areas soak up most of the auditor’s time. Several of them overlap with Atlassian’s own security requirements for cloud apps, so one piece of work can satisfy both.
App Scopes and Least-Privilege Permissions
Atlassian’s security requirements tell partners to request only the scopes an app needs for its core features. Auditors apply the principle of least privilege the same way. Expect to explain why each scope exists, who approved it and how you review it when features change. An app that asks for admin-level scopes to support one minor feature is a finding waiting to happen.
Tenant Isolation and Customer Data Handling
Every Marketplace app serves many customers from the same code, so auditors want to see how you keep one customer’s data away from another’s. That means a tenant identifier enforced on every query and tests that prove it works. You also need clear rules on what data you keep, where and for how long. If you run Forge Remote or a Connect backend, your retention and deletion process has to work per tenant, including when a customer uninstalls.
OAuth Tokens, API Tokens and Secrets Management
Atlassian bans Marketplace apps from collecting, sending, or storing Atlassian user account API tokens. Beyond that, auditors check where you keep OAuth credentials, shared secrets and signing keys, who can read them and how quickly you can rotate them. Secrets sitting in an environment file on a developer’s laptop won’t pass.
Secure SDLC, Dependency and Supply Chain Security
Atlassian doesn’t allow apps to ship third-party libraries with known critical or high vulnerabilities, and its scanners look for them. Auditors want to see the process behind that: code review, dependency scanning in CI, protected branches, and controlled releases. NIST’s Secure Software Development Framework is a good reference for structuring these controls in a way auditors and enterprise buyers will both recognize.
Vulnerability Management and Atlassian Remediation Timelines
Atlassian shortened its remediation deadlines for cloud apps and started enforcing them on September 1, 2026. Write your vulnerability management policy around these deadlines rather than a generic industry default. Auditors test you against what your policy says, and Atlassian enforces what its own policy says.
| Severity ([CVSS](https://www.first.org/cvss/) score) | Cloud apps | Data Center apps |
|---|---|---|
| Critical (9.0 and above) | 10 days | 12 weeks |
| High (7.0 to 8.9) | 4 weeks | 12 weeks |
| Medium (4.0 to 6.9) | 12 weeks | 12 weeks |
| Low (below 4.0) | 25 weeks | 25 weeks |
Missing a deadline hits you commercially. Miss a critical one and Atlassian hides your cloud app from the Marketplace. Miss a high one and a badged app loses its badges on day one, then gets hidden after 15 days.
Data Residency, Data Egress and Subprocessors
Enterprise buyers ask more and more often where their data goes and who else touches it. Keep a current subprocessor list, document every route data takes out of your systems, and know which regions you can pin data to. The same information feeds your SOC 2 system description or ISO 27001 Statement of Applicability, your Trust Center, and the data residency support Enterprise Certified asks for.
Incident Response and Notifying Atlassian and Customers
Your incident response plan needs a section just for Marketplace incidents. Atlassian coordinates incident response with partners and tracks vulnerabilities in its AMS Jira project. Your plan should say who watches AMS tickets, who talks to Atlassian, and who tells affected customers and how fast. Test it with a tabletop exercise based on a realistic Marketplace scenario, like a leaked OAuth secret.
Penetration Testing and Bug Bounty Evidence for Marketplace Partners
Neither SOC 2 nor ISO 27001 explicitly requires a penetration test. Auditors and enterprise buyers expect one anyway, and Atlassian now requires it for Enterprise Certified.Atlassian Marketplace Bug Bounty Program (Bugcrowd)
Every partner tier has to take part in the bug bounty program, and the number of apps it covers grows at each tier. Atlassian has also made Marketplace bug bounty programs public by default, and every cloud app program had to be public by June 30, 2026. A public program brings in a steady stream of findings, so get your remediation process ready before you open it up.Annual Penetration Testing With a CREST-Accredited Provider
Atlassian launched a Marketplace Penetration Testing Program in January 2026. Atlassian scopes the test, usually at two to five testing days, and runs it through Bugcrowd at a flat $1,000 per testing day. You can also use your own provider and still earn comparable trust signals, as long as they’re on the CREST-approved list and you report findings to Atlassian and fix them on time. Enterprise Certified requires a test every year.Using Pentest Results as SOC 2 and ISO 27001 Evidence
One well-scoped annual test can cover three audiences: Atlassian’s program, your SOC 2 or ISO 27001 auditor, and the enterprise security reviewer who asks for a summary letter. Run it inside your SOC 2 observation window or before your ISO 27001 Stage 2 audit, and keep the remediation tickets. Auditors care how you fixed the findings as much as whether you ran the test. Axipro’s CREST certified penetration testing services cover scoping for Forge and Connect apps, with reports written for both Atlassian and your auditor.Pro Tip: A Bug Bounty
A bug bounty doesn't replace a pentest. Bounty researchers go after whichever bugs pay the most for the least effort. A scoped test works through your authorization model, tenant boundaries and Forge Remote endpoints one by one, and that's the evidence auditors and enterprise buyers want to see.
Setting Up a Third-Party Validated Trust Center
A Trust Center is a public page where buyers can see your certifications, request your SOC 2 report under NDA, and download security documents without emailing your team. Platinum partners need one validated by a third party, and Enterprise Certified requires a public one.
Trust Center Providers Atlassian Recognizes
Atlassian’s program page lists Drata, Vanta, and SafeBase as recognized Trust Center providers and says the list isn’t final yet. Any other provider has to go through an internal Atlassian review. If you already use a GRC platform for SOC 2 or ISO 27001, its built-in Trust Center is usually the quickest option.
What to Publish: Reports, Policies, Subprocessors and Pentest Summaries
Put up your SOC 2 report or ISO 27001 certificate (behind an NDA if needed), your core security policies, and your subprocessor list. Add your data residency options, a pentest summary letter, and your privacy policy. Link your public status page too if you have one, since Enterprise Certified asks for uptime visibility. A good Trust Center answers the first round of security questions before the buyer gets around to asking them.
Timeline to Certification Before the July Program Review
Everything here works backward from one date: July 1, the cutoff for security and trust submissions in Atlassian’s annual review.
Readiness and Gap Assessment
Start with a gap analysis against the standard you’ve picked. It tells you which controls you have, which are missing, and which exist but leave no evidence. With managed support, SOC 2 readiness typically takes around four weeks, and ISO 27001 certification readiness can take as little as six. Small app teams usually find that writing policies and setting up evidence take longer than the technical fixes.
SOC 2 Observation Window vs ISO 27001 Stage 1 and Stage 2 Audits
SOC 2 Type 2 needs an observation period, usually at least three months for a first report, followed by the auditor’s fieldwork and write-up. ISO 27001 has no observation window. You do need a working ISMS and a finished internal audit and management review. Then come two audits: Stage 1 reviews your documentation and Stage 2 checks how your controls work in practice. For a partner starting late in the year, ISO 27001 is usually the faster way to a valid certificate.
Worth Knowing: Axipro worked with Narva Software
Axipro worked with Narva Software, a German Atlassian partner that builds Jira and Confluence apps, on its SOC 2 readiness with Vanta. With ten people or fewer, Narva's hard part wasn't the controls. It was writing the policies and coordinating the work without stalling product development. Narva has since held Gold Marketplace Partner status with a SOC 2 Type II report.
Working Back From the July Review Date
Here’s a realistic plan for a partner with no existing program aiming at a July 1 cutoff.
| Month | SOC 2 Type 2 route | ISO 27001:2022 route |
|---|---|---|
| November to December | Gap analysis, policies, GRC platform setup | Gap analysis, risk assessment, ISMS scope |
| January | Remediation, evidence collection begins | Controls implemented, Statement of Applicability |
| February | Observation window opens | Internal audit and management review |
| March to April | Observation window continues, pentest | Stage 1 and Stage 2 audits |
| May | Observation window closes | Certificate issued, Trust Center updated |
| June | Auditor fieldwork and report | Buffer for nonconformities |
Start in March, and there’s almost no room left for a SOC 2 Type 2 report, though ISO 27001 can still work if the team moves fast. Start after April, and you’re realistically aiming at the following year’s review.
Maintaining Compliance Between Annual Reviews
Certification doesn’t end once you have the report. A SOC 2 Type 2 report covers a fixed period, so you’ll need a new one every year to stay current. ISO 27001 needs a surveillance audit every year and full recertification every three years. Schedule your SOC 2 period end or ISO surveillance audit a few months before July, so you always have a fresh report or confirmation when the review comes around.
Compliance Automation for Small Marketplace App Teams
Most Marketplace partners are small engineering teams without anyone working on security full-time. Automation makes certification realistic for them, but it won’t do the whole job.
Atlassian’s Vanta for Marketplaces Offer
Atlassian partnered with Vanta on Vanta for Marketplaces and lists the partnership among the Atlassian-funded benefits of its partner program. According to Vanta, more than 400 Atlassian partners have achieved attestations through it or are working toward one. Ask your Partner Manager what the current offer includes and how long it runs, because you’ll keep paying for the subscription after the first year.
Where Automation Stops and Readiness Support Starts
A GRC platform tells you which tests are failing. It won’t write a risk assessment that reflects your Forge Remote setup or decide what’s in scope. It also can’t explain to an auditor why a control works differently for a Runs on Atlassian app. That judgment is where small teams lose the most time. Axipro’s SOC 2 compliance services and ISO 27001 certification support handle that part, from scoping and policies through control implementation and auditor coordination, with guaranteed certification on the Achievement Plan.
Typical Budget for a Small Marketplace Partner
You’ll pay for four things: the GRC platform subscription, the auditor’s fee, a penetration test, and your team’s time. The pentest is the easiest to estimate, since Atlassian’s program charges $1,000 per testing day and most scopes run two to five days. Auditor fees depend on scope. A Forge-only app with a small team costs far less to audit than a Connect app with its own cloud setup. Internal time is the cost most partners underestimate, so budget engineering hours for remediation and evidence as well as the invoices.
The Bottom Line
Atlassian asks for SOC 2 Type 2 or ISO 27001:2022, not both. Silver partners don’t need either yet, while Gold and Platinum partners do. Enterprise Certified goes further, adding annual CREST pentests, data residency and a public Trust Center. Pick the standard your buyers ask for, scope the audit around how your app really works, match your vulnerability policy to Atlassian’s deadlines, and start early enough that your evidence exists before July 1.
Frequently Asked Questions
Do Silver Marketplace Partners need SOC 2 or ISO 27001?
No. Silver partners don’t need either one. They need $150K a year in cloud sales, support responses under 48 hours and their most-installed paid cloud app in the bug bounty program. If you expect to reach Gold, start preparing about a year ahead.
Does Atlassian accept SOC 2 Type 1 for Gold or Platinum status?
No. Atlassian asks for SOC 2 Type 2, which tests your controls over an observation period. A Type 1 report can help your sales team while the Type 2 window runs, but it won’t meet the program requirement.
Does Atlassian's own SOC 2 report cover my Forge app?
No. Atlassian’s report covers Atlassian’s own platform and services. Your company, your staff, your development process and any Forge Remote infrastructure need their own controls and their own audit.
Is ISO 27001:2013 still accepted by Atlassian?
No. Atlassian asks for ISO 27001:2022, and every 2013 certificate expired or was withdrawn by October 31, 2025. If your 2013 certificate lapsed, you’ll need a full initial certification audit against the 2022 edition.
Do I still need a pentest if I'm in the Marketplace Bug Bounty program?
For Enterprise Certified, yes. It requires both bug bounty participation and an annual third-party CREST pentest. The partner tiers don’t list a pentest as a requirement, but SOC 2 and ISO 27001 auditors and enterprise buyers routinely expect one. Tests run through Atlassian’s Penetration Testing Program will also count toward a future “Penetration Test” trust signal on your listing.
