Last updated Nov 10, 2020

The rollout of data residency for Forge hosted storage has started. Stay tuned to Forge Changelog for updated information.

This section describes a Forge preview feature. Preview features are deemed stable; however, they remain under active development and may be subject to shorter deprecation windows. For more information, see Forge release phases: EAP, Preview, and GA.

Data residency (Preview)

To help partners more easily meet customer data residency needs, we have enabled data residency support for apps that choose to exclusively use Forge hosted storage (for example, the Storage API). These apps will be able support data residency for in-scope data with less separate investment (compared to supporting data residency for external databases).

Forge will take care of the hosting, pinning, and migration of hosted data between supported locations, so partners can focus on building a high quality app for their customers.

This solution is designed to work harmoniously with product data residency and consequently is based on similar concepts and terminology.

For more information about how the Atlassian cloud addresses the data residency needs of organizations, see Manage data residency

How it works

Jira and Confluence users on the Atlassian cloud can move their data to any supported location. When this occurs, the Atlassian cloud infrastructure will migrate the customer’s product data to that location.

In line with this, we have enabled data residency support for apps that choose to use Forge hosted storage. Since Forge uses a similar cloud infrastructure for its hosted storage, partners that choose to store their app’s data on Forge hosted storage will enable Forge to move that data to an admin’s chosen location.

This means that the data from both product and all Forge apps using hosted storage will be hosted in the admin’s chosen location. As a result:

If an admin installs an Forge app using hosted storage on a product that’s pinned to a location, the app will automatically be located there too.
If an admin migrates the data of a pinned product to a different location, then all installed, Forge apps using hosted storage will also be migrated there as well.

Apps that are eligible will be shown with a PINNED status to the admin.

Forge will aim to execute its invocations from the same location as the host product. See Multi-region compute for more details.

Eligibility

A Forge app is eligible for PINNED status if it stores all its in-scope End-User Data exclusively on Forge's hosted storage.

Forge apps that store in-scope End-User Data on a remote back end are ineligible for PINNED status. By default, Forge will assume that an app is storing such data remotely if it includes the following in its manifest file:

An external domain defined in fetch (see Runtime egress permissions for additional details)
Any remote defined (see Forge remote for additional details)

If your app uses an external or remote backend but doesn’t use it to store in-scope End-User Data, your app is eligible for PINNED status. However, you'll need to configure this accordingly in the manifest file. For information on how to do this, see Remotes.

In addition, when an admin initiates moving their Jira or Confluence instance to a location, they’ll see which apps can move at the same time. These will include Forge apps that are eligible for PINNED status can move at the same time as the product:

Eligible apps moving with the product

In-scope End-User Data

Forge developers will be responsible for defining, documenting, and communicating with their customers what data is in-scope and out-of-scope for data residency for their Forge app (see Atlassian’s in-scope data as an example). Admins use this list of information to understand an app’s suitability and compliance with relevant data residency regulations.

You’ll need to publish what data your app considers in-scope and out-of-scope for data residency in your own documentation.

PINNED product status

When an admin moves their Jira or Confluence data to a location, that product’s Product status will then appear as PINNED in the admin’s Data residency interface:

Product pinned to Europe

The PINNED product status lets admins verify that their product’s in-scope product data is hosted on the chosen location. You can learn more about how admins pin their product data in Move product data to another location.

In-scope product data refers to all data stored by an Atlassian product that can be pinned. See Understand data residency for more information.

PINNED app status

After an admin verifies that their product data is pinned to a location, they also need to verify that all in-scope end-user data for an app is also pinned. Apps pinned to the same location as the product will be displayed as PINNED in the admin's Data residency interface:

App pinned to same location as product

The PINNED app status provides admins with the verification that an app’s data is hosted in the same location as the product.

When an admin installs an eligible Forge app on a product that is already PINNED, the app will automatically be displayed as PINNED as well.

Supported locations

Admins can pin their product data and hosted Forge app data to a number of supported locations, namely:

Global: In-scope data is hosted within realms determined by Atlassian: data may be moved between realms as needed.
EU: In-scope data is hosted within the Dublin AWS regions.
US: In-scope data is hosted within the US East and US West AWS regions.
AU: In-scope data is hosted within the Sydney AWS region.
DE: In-scope data is hosted within the Frankfurt AWS region.
SG: In-scope data is hosted within the Singapore AWS region
CA: In-scope data is hosted within the Canada AWS region
IN: In-scope data is hosted within the Mumbai AWS region
KR: In-scope data is hosted within the Seoul AWS region
BR: In-scope data is hosted within the São Paulo AWS region
JP: In-scope data is hosted within the Tokyo AWS region
GB: In-scope data is hosted within the London AWS region
CH: In-scope data is hosted within the Zurich AWS region

Data residency for Forge hosted storage will automatically include any new location that the Atlassian cloud infrastructure supports.

Multi-region compute

Forge will aim to execute its invocations from the same location as the host product. This helps Forge optimize for an app’s reliability and performance (as well as facilitate security and fraud prevention).

To support some Atlassian cloud capabilities, Forge may sometimes execute an app’s invocation from a location other than the location where the host product is.

Observability

Tracking, logging, and auditing is an integral part of supporting data residency. As such, we’re working on a new set of audit log features that will allow you to do just that. These features will allow you to track important details, such as which locations your app is pinned to.