Atlassian Intelligence and Rovo

Atlassian Intelligence and Rovo combine open-source, self-hosted models, and 3rd party hosted models to deliver a personalized artificial intelligence experience tailored to you, your teams, and your workflows.

These LLM providers will not store customer inputs and outputs nor will they use this data to train their services. This approach prioritizes the privacy of your data throughout the entire process.

To learn more about the technology that underpins Atlassian Intelligence visit this page. 

Some of the models used as part of our AI-powered features generate responses based on your inputs and are probabilistic in nature. This means that their responses are generated by predicting the most probable next word or text, based on the data that they have been trained on.

Because of this approach, these models can sometimes behave in ways that are inaccurate, incomplete, or unreliable. For example, the responses that you receive could not accurately reflect the content they are based on, or generate content that sounds reasonable but is incomplete and should not be relied on.

We encourage you to think about the situations when you use these features — for example, not in cases where you need current and accurate information about people, places, and facts — and review the quality of the responses you receive before sharing them with others.

Atlassian Intelligence and Rovo process your user’s inputs to provide the outputs your user has requested. We may also process organizational data from within your site that the user has permission to view and include that data with the user inputs so that LLMs can provide more accurate, relevant, and contextual responses.

The LLM providers we use do not use your inputs and outputs to improve their services. Neither OpenAI nor any other LLM provider retains your inputs and outputs.

In addition to the restrictive policies we have put in place for our LLM providers, we also limit the use and access of customer data within our platform. Customer inputs and outputs are used only to serve and improve individual customer experiences. They are not used for model training across customers.

Atlassian may store your inputs and outputs for a limited period of time to reduce latency, such as when displaying a page summary, or when required to provide a feature, such as displaying a search history. To learn more about how each feature uses customer data, please visit our transparency page.

If you would like to be notified of any material changes to this policy, please subscribe here.

We use a diverse range of open-source, Atlassian-hosted LLMs, including models from the LLama series, Phi series, and Mixtral, alongside third-party hosted LLMs from OpenAI's GPT series of models, Anthropic's Claude series of models, and Google's Gemini series of models, to deliver the best outcomes for customers. Our features use dynamic routing to select the appropriate mix of models that can deliver the best experience and accuracy for each scenario.

The LLM providers we use do not retain your inputs and outputs, or use them to improve their services.

No, none of our LLM providers store the data you submit or the responses you receive.

The data you submit and the responses you receive via Atlassian Intelligence and Rovo are not used to fine-tune or improve any LLM models or services. For third-party hosted models, each data request is sent to the external provider individually over an SSL encrypted service, to process and send back to Atlassian.

Atlassian Intelligence and Rovo leverage dynamic routing between models, and do not support provider selection.

Atlassian Intelligence and Rovo do not use your inputs or outputs to train Atlassian products and services. These features only use data about how you interact with our features, such as the people you work with and the size and type of attachments, and feedback you provide.

The data you submit and the responses you receive are used only to serve your experience. They are not used to train models across customers or shared between customers.

When using Atlassian Intelligence and Rovo, data is transferred outside of the current site to third party LLM providers (e.g., OpenAI) in order to generate a response. Even though the data is transferred, it follows existing Atlassian security practices. For Atlassian Intelligence and Rovo, each data request is sent to our LLM providers individually, over an SSL- encrypted service, to process and send back to Atlassian.

Please refer to our list of data sub-processors for more information on our external LLM providers.

Yes. If you are an admin, you can log into Atlassian Administration and remove Atlassian Intelligence at the individual product level. Once deactivated, you will see a confirmation flag in your instance. For more details please review our documentation or contact support directly.

Yes, the Atlassian Customer Agreement covers both Atlassian Intelligence and Rovo.  Additionally, the policies and terms incorporated by reference in the Atlassian Customer Agreement, including the Privacy Policy, Acceptable Use Policy, Data Processing Addendum, Product-Specific Terms, govern your use of Atlassian Intelligence and Rovo.

If your request does not align with our customer terms, it may not be fulfilled by these services.

Atlassian Intelligence and Rovo respect all of your existing permissions. In fact, two users may receive different results based on the content they have access to.

The data a user has access to is not limited to the product they’re working on. Due to the connected nature of our products, as long as a user has access to a Jira issue or Confluence page, information can be pulled from across those experiences to inform a response (or output).

This policy extends to any third party connector you have in Rovo. All permissions set in our platform as well as in your third party connector source will be respected as long as they are set accordingly.

In addition to the restrictive policies we have in place with our LLM providers, these features continue to follow our existing security practices we have for each product. We are currently in the process of getting Soc2 and ISO27001 compliance to validate our approach and should have that by the end of 2024.

To get a deeper look at how our LLM providers secure their platforms, please visit our subprocessor page.

Not at this time. If you have data residency turned on, all of your in-scope product data will remain stored in the region you’ve selected. However, Atlassian Intelligence and Rovo data may be stored outside of that region, specifically in the US in order to appropriately deliver their services.

We are committed to helping our customers stay compliant with GDPR and their local requirements.  As we do today for all of our products, we will process and transmit data for Atlassian Intelligence and Rovo in accordance with our Privacy Policy, Data Processing Addendum, and GDPR commitment.

Although many of the systems and services used by Atlassian Intelligence and Rovo hold these certifications and adhere to the same internal policies and standards, these features itself have not completed external assessment for SOC 2 or ISO certification. We aim to have these features added to our standard audit certification reporting cycle before the end of the year.

No, at this time Atlassian Intelligence and Rovo are not HIPAA compliant and our Business Associate Agreement (BAA) does not cover these features. If you are required to comply with HIPAA, we recommend that you do not turn these features on until we have expanded our coverage to include them.

We currently only offer opt-out controls at the product level. We plan to offer more granular controls to customers in the coming months and will update this page once controls are available.

Atlassian Intelligence and Rovo honor all existing permissions within each feature. Users will not be able to create or generate content based on resources they do not have access to.

Ex. #1. You would not see issues/projects that you do not have access to if you do a natural language search to JQL or you would not get Confluence pages sourced for an answer to a question if you did not have access to those pages.

Ex. #2. if a Confluence user executes a smart search, the results shown will take into account the pages and spaces the user has permission to view, and ignores restricted pages and spaces.

Visit our guide on Atlassian Intelligence to learn how teams can accelerate work, increase efficiency, and provide value faster.