Atlassian is retiring Cloud Fortified, and a new Marketplace badge is taking its place: Atlassian Enterprise Certified (AEC). The badge signals that an app has met enterprise requirements for security, reliability, privacy, accessibility, and responsible AI use.
Here’s the timeline: Atlassian no longer accepts new Cloud Fortified submissions, and existing Cloud Fortified badges stay visible through December 31, 2026.
This blog explains what the new status means, how it compares to Cloud Fortified, and why it matters to the teams choosing apps.
Back to topWhat Is Atlassian Enterprise Certified?
Atlassian Enterprise Certified is an Atlassian-run program that recognizes Marketplace apps built to meet common enterprise needs.
Every Cloud app on the Marketplace has to clear Atlassian’s baseline security requirements, but AEC goes further, with Atlassian verifying an app’s compliance, security, reliability, privacy, accessibility, and AI practices.
The program is open to apps built on Forge, Atlassian’s cloud development platform.
Customers can spot AEC apps in three places:
- A dedicated AEC trust filter in the Marketplace.
- App tiles on search and category pages.
- App listings, alongside other trust signals like Runs on Atlassian.
Why Atlassian Enterprise Certified Matters
Vetting a Marketplace app often means a long back-and-forth of security questionnaires. AEC shortens that process. Atlassian combines automated vulnerability scans, independent compliance audits, and expert manual reviews into one certification so your security, legal, and procurement teams can move faster with confidence.
Certified apps also publish their trust evidence upfront in a public trust center, so your team doesn’t have to wait on a custom answer for every question.
AEC covers more than security, too. It looks at privacy, data residency, accessibility, and how an app handles AI—an important factor that will only matter more as more apps continue to add new AI features.
Back to topAtlassian Enterprise Certified Requirements
Atlassian groups the requirements into four pillars.
Pillar | What Atlassian verifies |
Security | Annual third-party penetration test, public bug bounty program, automated vulnerability scanning, least-privilege data access, encryption at rest for data stored outside Atlassian |
Privacy and compliance | SOC 2 Type II or ISO 27001, data residency support, documented data retention and deletion, public trust center and privacy policy |
Reliability and support | Public status page, incident response coordinated with Atlassian, 24-hour response to critical support issues, 5 days a week |
Accessibility | Public Voluntary Product Accessibility Template (VPAT) |
| Responsible AI | AI usage policy where the app uses AI |
Cloud Fortified Requirements
To meet the Cloud Fortified standard, Atlassian Marketplace apps were required to meet advanced criteria and practices for enterprise-grade reliability, support, and security.
Security within the Atlassian Ecosystem
All Atlassian Marketplace apps are monitored to identify common vulnerabilities and exposures, participate in vulnerability disclosure programs, and are required to adhere to specific fix timeframes for vulnerabilities. To qualify for the Cloud Fortified designation, apps must also participate in Atlassian’s Marketplace Bug Bounty program and complete additional security self-assessments.
Reliability for Marketplace Apps
Only Cloud Fortified apps are held to specific reliability standards, which made the program an important differentiator for enterprise customers. Members of the Cloud Fortified program also share processes with Atlassian to ensure that any incidents are quickly resolved. Cloud Fortified apps will proactively work with Atlassian to ensure that any product updates are compatible, ensuring a smooth experience for all users as they make improvements.
Leading Support for Customers
The Cloud Fortified program requires that support teams maintain a response time less than 24 hours and provide support at least five days per week. Gliffy has met this standard for several years — and our support team is happy to help our customers 24 hours a day, 5 days a week.
Back to topAtlassian Enterprise Certified vs. Cloud Fortified: What Carries Over and What’s New
Both programs signal enterprise readiness, and they share a foundation. Cloud Fortified launched in 2021 with three focus areas: security, reliability, and support. AEC keeps those and adds privacy, accessibility, and AI governance.
| Cloud Fortified | Atlassian Enterprise Certified |
Focus areas | Security, reliability, support | Security, reliability and support, privacy and compliance, accessibility, responsible AI |
Security | Bug bounty participation and security self-assessments | Bug bounty participation, annual third-party penetration test, vulnerability scanning |
Support | Response in under 24 hours, 5 days a week | Response within 24 hours for critical issues, 5 days a week |
Status | Closed to new submissions, badges visible through December 31, 2026 | Open now to eligible Forge cloud apps |
- What carries over: a bug bounty program, vulnerability fixes, teamwork with Atlassian on incidents, and fast support
- What’s new: outside audits for compliance, data residency, a public trust center, accessibility reports, and AI usage policies
Atlassian Enterprise Certified Diagramming
Gliffy got there first. For teams that diagram in Confluence, that means a diagramming app Atlassian has verified. It meets enterprise standards for security, reliability, privacy, accessibility, and responsible AI use. See how Gliffy approaches security and compliance, or explore Gliffy Diagrams for Confluence.
Back to topAtlassian Enterprise Certified FAQ
What is Atlassian Enterprise Certified?
It’s an Atlassian Marketplace badge for apps that meet enterprise requirements for security, reliability, privacy, accessibility, and responsible AI use. Atlassian verifies each requirement.
Is Atlassian Enterprise Certified replacing Cloud Fortified?
Yes. Atlassian no longer accepts new Cloud Fortified submissions, and existing badges stay visible through December 31, 2026.
Which apps can earn Atlassian Enterprise Certified?
The program is open to Forge cloud apps that meet the requirements.
How does Atlassian Enterprise Certified help procurement teams?
Certified apps publish their trust evidence upfront, and customers can filter the Marketplace for AEC apps. That gives procurement and security teams a faster starting point for reviews.