Hi everyone, thank you for providing your valuable feedback around this important topic.
As we described in our initial post, when a partner chooses to use data residency within Forge Hosted Storage, then any data they store in Forge Hosted Storage will be migrated to and stored in the same location as the Atlassian customer’s host product(s). Some of you have asked whether storing data in a location chosen by the customer is consistent with Atlassian’s role as your processor (or sub-processor) under the EU and UK GDPR.
The short answer is: yes, it is. Forge Hosted Storage is a single, optional component of our Forge platform. You, as a partner, determine whether or not to use Forge Hosted Storage for your app. If you do not build your app to use Forge Hosted Storage, it will not be enabled. Put another way, if you instruct us to enable data residency, then we will comply with your data residency instruction consistent with our processor obligations. We do not make the decision to enable data residency for you.
Every data storage service comes with certain terms and conditions attached, and these necessarily include restrictions on where data can be stored. For example, if a partner utilises a hosting service that only has servers in the US and Ireland, then it can’t expect to store data in Germany - this is simply a limitation of the service provided. The data residency offered by Forge Hosted Storage is no different in this respect - our condition being that, if you enable data residency, we will store data in the location our (and your) customers have said they want to use.
Additionally, we have validated this feature with outside counsel, who have confirmed that Atlassian, when acting as either a processor or sub-processor, is able to comply with applicable privacy laws when providing data residency for Forge Hosted Storage in this manner.
Remember, though - you are always in control. If you don’t want to use data residency in Forge Hosted Storage, there’s no requirement to do so. Forge Hosted Storage will only ever be enabled if you choose to turn it on.