Marketplace App Licensing

The Atlassian Marketplace is a platform for Atlassian customers to discover, try, and buy apps for Atlassian products. You can use apps to customize and extend your Atlassian product. The Marketplace offers apps developed by both Atlassian and third-party developers.

Apps are small pieces of code that you (or your administrator) can install into your Atlassian product to enhance or change its functionality. Apps can also be remotely contained web applications that integrate into cloud sites. You can enable, disable, install, and uninstall apps anytime from the administration pages of your Atlassian product.

Apps change the way your Atlassian application behaves. Even though apps are designed to enhance your product, there can be unintended effects. When you use or install apps, you do so at your own risk. While third-party apps aren’t supported by Atlassian’s technical support team, many vendors provide support via their own support portals. Learn more on each app’s marketplace listing.

The Marketplace sells apps written by both Atlassian and third-party developers. You can even write one yourself.

Platform availability is at the discretion of the app creator. Each Marketplace app listing will reflect cloud or Data Center/server availability.

Atlassian checks entries in the Atlassian Marketplace to ensure that app information is as complete as possible. However, we don't actively monitor or guarantee any code posted in this space. If you find dangerous or malicious code posted here, contact us immediately so we can take action.

Log in to Atlassian Marketplace with your Atlassian account. If you don't have an Atlassian account, you can create one and then log in to the Marketplace.

Because Marketplace apps are offered by third-party Marketplace Partners, install an app only if you trust the app and the Marketplace Partner. On the Marketplace, you can see which apps are participating in the different security programs, and find partner-provided information about how apps handle data on the Privacy & Security tab on the app’s listing on Atlassian Marketplace. Please take care to evaluate apps against your company’s privacy, security and compliance requirements, as you are entering into an independent relationship with the Marketplace partner, separate from your relationship with Atlassian (see Section 6.2 of our Cloud Terms of Service and our Privacy Policy under “Third Party Apps”).

There are multiple factors to consider when evaluating third-party apps. Some of these include:

• Security
  • All Marketplace cloud apps are subject to Atlassian’s Cloud App Security Requirements.
  • All cloud apps are scanned daily by Atlassian’s Ecoscanner platform.
  • All Marketplace Partners are required to abide by Atlassian’s Security Bug Fix Policy.
  • Look for the Cloud Security Participant badge. This represents an app that is currently participating in the Marketplace Bug Bounty Program.
  • Look for the Cloud Fortified badge, which indicates that an app has made additional investments in security (including participation in the Marketplace Bug Bounty Program), reliability and support.
  • Review partner-provided details on the Privacy & Security tab on the app’s listing on Atlassian Marketplace.
• Data management and privacy
  • Review the partner's Privacy Policy provided on the app listing.
  • Review partner-provided data handling and privacy practices on the Privacy & Security tab.
• Support
  • Look for the Cloud Fortified badge, which indicates that an app has made additional investments in security (including participation in the Marketplace Bug Bounty Program), reliability, and support.
  • Check that an app is listed as supported and has a support contact.
• Assurance and trust
  • Read reviews and ratings on the Marketplace.
  • Check the number of active installations to assess popularity.
  • From the Support tab, look for the availability of a public issue tracker or support resources.
  • See if compatibility is kept up-to-date from the Versions tab.
  • Review screenshots and videos from the Overview tab.
  • See if the developer provides a License Agreement.

You can also ask a question in the Atlassian Community.

The Marketplace Partner Program is comprised of three partner levels: Platinum, Gold, and Silver. These scaling levels recognize each partner's individual investment in the Atlassian platform and alignment with our strategy.

These Platinum, Gold, and Silver Marketplace Partners have met Atlassian requirements on:

• Cloud and Data Center: Partners are investing in cloud and have Data Center Approved versions of their high-traction server apps.
• Security: Partners are up-leveling their security practices by participating in our Marketplace Security Programs. For cloud apps that participate, we are introducing a new security badge on Marketplace so customers can make informed security decisions.

The Atlassian Partner Program allows us to ensure that customers have great experiences and reward partners who are most aligned with our objectives.

For more details on the Marketplace Partner Program, please see the program requirements.

The Security Self-Assessment Program is a collaboration between Atlassian and app partners to increase security awareness and improve security practices. A partner may apply to the program via an annual self-assessment that addresses the following: 

• Data security
• Sensitive data handling
• Backups and disaster recovery

The self-assessment answers are reviewed by the Atlassian staff. The self-assessment encourages partners to consider security carefully and allows Atlassian to make suggestions towards better security. It works on an honor system. We advise that you take any additional necessary steps to ensure the partner and app meets your company's security requirements. See details about the Security Self-Assessment Program.

It depends on the app. Atlassian Marketplace Partners are able to decide if they would like to provide support and maintenance for every app listing. We make this information available on every listing in the Atlassian Marketplace.

If the Atlassian Marketplace Partner has decided to provide customer support and maintenance for the app, the listing will show that the app is "Supported". Should you need support for the app, you should contact the app Partner via the "Get Support" button on the support tab of the app listing details page. If the Atlassian Marketplace Partner is Atlassian, the "Get Support" button will take you to Atlassian’s support ticketing system (support.atlassian.com). All other requests go to a support resource provided by the Atlassian Marketplace Partner. We’ve found this to be the fastest way to get your issues resolved.

Atlassian Marketplace Partners have different hours of operations and service level agreements than those provided by Atlassian Support, regardless of your Atlassian support tier. If you'd like to give Atlassian feedback about your support experience with Marketplace Partners, please visit marketplace.atlassian.com and select "Feedback" from the Help dropdown in the header.

If the Atlassian Marketplace Partner has decided not to provide customer support and/or maintenance, the app listing will show "Unsupported". Should you need support for an unsupported app, you should raise a request with the online community (community.atlassian.com). Please note that there are no guarantees for issue resolution with unsupported apps from the Atlassian Marketplace Partner or Atlassian.

Sometimes, yes. It's possible for an app to cause performance problems. For this reason, we recommend learning all you can about an app.

You can try an app in a staging environment before deploying it in production. You can also use customer reviews to learn what other users have to say. Visit the website of the app partner and review any support materials they have.

If you suspect an app is causing a problem in your Atlassian product, try disabling the app to see if the issue persists.

Administrators have full access to monitor and manage apps. To view, update, and configure apps in your site, administrators can use our Universal Plugin Manager (UPM).

For information on how to use UPM, please see our Universal Plugin Manager (UPM) documentation.

To focus on current, relevant apps, the Atlassian Marketplace regularly archives apps that are out-of-date or, for any other reason, no longer relevant to the Marketplace.

Archiving prevents the apps from appearing in search results or in-app browsing lists. The Marketplace archives apps automatically if the time since the end-of-life of the latest version of the Atlassian product it supports is greater than one year.

If you already have a license for an archived app, you can still download the app from its Marketplace listing and use it. However, new licenses for the app are not available. Contact the Partner to inquire about an updated version of the app.

Marketplace apps are available to customers everywhere, except for those in trade embargoed countries subject to US export restrictions.

A bug bounty program is one of the most powerful post-production tools you can implement to help detect vulnerabilities in your applications and services. Crowdsourcing vulnerability discovery augments the skills of your team by providing access to a skilled pool of security researchers.

The Atlassian Marketplace Bug Bounty Program is hosted on Bugcrowd, a SaaS platform built to crowdsource vulnerability discovery from a global pool of talented security researchers. Marketplace Partners who join this program allow the security researchers to test their applications for security vulnerabilities who are then rewarded based on severity of the vulnerability discovered. The result is a cost efficient solution for Marketplace Partners to discover and fix vulnerabilities in their apps on an ongoing basis which results in more secure apps for customers.

Marketplace apps that are currently participating in the Marketplace Bug Bounty Program are identifiable by the security badge on their Marketplace app listing. For more information on how the Marketplace Bug Bounty Program is run, please review the information on our Developer page.

The Cloud Fortified program is a Marketplace program designed to help customers find cloud apps that offer advanced security, reliability, and support.

Cloud Fortified apps meet all of Atlassian’s cloud security requirements and show their own investment in cloud security by participating in the Marketplace Bug Bounty program and providing complete information on the privacy & security tab of their Marketplace listing. They also meet additional requirements for reliability at scale. Cloud Fortified apps also meet a 24 hour response time, 5 days a week support SLA.

You can learn more about Marketplace cloud programs and badging here, or get more details on the technical requirements of Cloud Fortified by reviewing the program documentation here.

The actions an app can perform and the information an app can request in your Jira, Confluence, or other Atlassian instance vary depending on the app and are at the discretion of the Marketplace Partner. This is because apps have different requirements depending on their function.

Some apps have a longer, more granular and detailed list of actions and information they can request in order to ensure they are only requesting information they absolutely need. These apps also provide more detailed information to customers about the specific actions and information required.

A longer list of app actions does not mean an app has access to more of your Jira or Confluence instance.

If you have questions or concerns about an app’s level of access, please reach out to the app’s supplier (typically a Marketplace Partner).

In order to help companies maintain control over their Atlassian environment, most Marketplace apps can only be installed by admins. End-users are also able to shop for apps and notify their admins about apps they’d like to use by selecting “Try it free” → “Request this app” on any Marketplace app listing.

By default, apps built using the OAuth 2.0 (3LO) framework can be installed on cloud instances by end-users without admin approval. Admins can prevent end-users from installing OAuth 2.0 (3LO) apps using a control in the Admin portal. Admins can toggle on or off end-user app installs at any time.

Marketplace Partners are able to change prices for their apps every 30 days. Atlassian highly recommends that Marketplace Partners communicate price changes with their existing customers, and most Marketplace Partners are committed to proactively communicating in this regard.

If you're using a Marketplace app that increases in price, you will have a 60-day price override you can use to pay the lower price when you renew or purchase. You will receive the renewal price override long as you're on the same product edition and the quote is created before the renewal override date (60 days from the price change).

Even if you're just trialing an app, you can pay the lower price if you purchased the app before the trial expires. If you're trialing an app in server/Data Center you'll receive the new price, unless you have a pre-existing quote.

If the new price isn't acceptable to you and you'd like to request an adjustment, you can reach out to the Marketplace Partner directly to see if a promotion might be applied.

Purchase the license tier that matches the number of users you have licensed for your host product. For example, if you have a 25-user Confluence license, purchase the Confluence app at the 25-user tier. The app will only function if its license matches or exceeds the tier of the host product – even if only some of your licensed users need to use the app.

For Jira, you must purchase the app license that matches the highest Jira application tier. For example, if you have a 500-User Jira Software license, and a 20-Agent Jira Service Management license, your Jira apps must be at the 500-User level. 

Cloud marketplace applications naturally match the tier of the host product within the cloud site and are unable to exceed the host product tier.

Jira Software Data Center and Confluence Data Center are licensed starting at 500 users. To match your Data Center product license, purchase app licenses to match or exceed the number of users you have for the Data Center approved app or server app (when a Data Center approved app is not available) you intend to use alongside your Data Center host product. You don't need to purchase a license for each node of your product, just the total number of users. This doesn't impact app functionality or compatibility; the number of users just need to match your Data Center subscription. 

Yes; Marketplace apps are licensed per environment. For self-managed installations, an app license is required for each unique environment. If you have a Data Center product running on multiple servers, this counts as one environment. 

For cloud, apps are licensed per subscription.

Self-managed app license keys and applicable source code are available via my.atlassian.com once payment has been received. Cloud apps will be renewed/extended/upgraded after receipt of payment.

You must not use sandboxes for production use cases such as load or performance testing, either manual or automated, other than in the course of testing changes or managing configuration between environments.

You will not use sandboxes for any illegal purpose, in violation of any laws, that infringes on anyone’s rights, is offensive, or interferes with the sandboxes or any features on the sandboxes (including any Atlassian Marketplace apps that may be installed). For more information how to enable sandbox licenses, go here.