# Can you license your company's Jira and Confluence data to AI companies? URL: https://sellmydatatoai.net/data-rights/atlassian Reviewed: 2026-11-08 Covers: Jira, Jira Service Management and Confluence Cloud Section 13 of the Atlassian Customer Agreement says "Customer owns all intellectual property and other rights in Customer Data," so Atlassian does not claim your Jira issues or Confluence pages. We found no AI-training clause, but the Atlassian Developer Terms say "You may not sell any End User Data" processed through Atlassian's platform, which makes API extraction unclear. Confirm your position with your own counsel. ## Atlassian data rights at a glance | Data available | Export method | Plan needed | AI-training restriction in the terms | | --- | --- | --- | --- | | Jira issues, comments and attachments | Cloud site backup, attachments optional | Site admin, one backup every 48 hours | No: no AI clause found. Customer Agreement §13: "Customer owns all intellectual property and other rights" | | Confluence spaces and pages | Space export to PDF, CSV, HTML or XML | Space admin, or site admin for all content in CSV and XML | No: no AI clause found in the Customer Agreement | | Data pulled through Atlassian APIs or Forge apps | REST APIs or a Forge app | Any plan, developer account | Unclear: Developer Terms §9.2: "You may not sell any End User Data." | ## Who owns your Jira and Confluence data under Atlassian's terms? Your company owns its Jira and Confluence content. Section 13 of the [Atlassian Customer Agreement](https://www.atlassian.com/legal/atlassian-customer-agreement) (effective October 1, 2026) says "Customer owns all intellectual property and other rights in Customer Data," which section 21 defines as data, content or materials provided to Atlassian by or at the direction of the customer. Section 2.2(d) bars customers from using the products "to develop a similar or competing product or service," and section 4.6 places AI offerings under separate AI terms. Section 4.4 says the documentation describes how you retrieve your Customer Data. Ownership against Atlassian does not clear the rights of customers and partners whose words sit in your tickets. Our guide on [whether you can legally sell company data](https://sellmydatatoai.net/guides/can-you-legally-sell-company-data-for-ai) covers that. ## What can you export from Jira and Confluence? Atlassian Cloud gives you site backups and space exports. - Jira and Confluence Cloud site backups can include attachments, avatars and logos, and Atlassian limits backups to one every 48 hours, as its public issue tracker records - Confluence space exports come as PDF, CSV, HTML or XML, with CSV, HTML and XML delivered as zipped archives - Space admins can export whole spaces. Other users export only what they can view, except site admins using CSV or XML, who get all content - Organization admins can block exports for particular products or classification levels Atlassian's guide [Export content to Word, PDF, HTML and XML](https://support.atlassian.com/confluence-cloud/docs/export-content-to-word-pdf-html-and-xml/) covers the Confluence options in detail. ## Do Atlassian's terms restrict AI training on Jira and Confluence data? Atlassian's terms say nothing direct about AI training. We found no such clause in the Customer Agreement. The open question is the [Atlassian Developer Terms](https://developer.atlassian.com/platform/marketplace/atlassian-developer-terms/) (last updated December 1, 2025), which "apply to all developers on the Atlassian Platform," including developers who are also end users of Atlassian apps. Section 9.2 says "You may not sell any End User Data," and defines End User Data as data of an end user accessed or processed by you or your app in connection with the Atlassian Platform, which includes Atlassian's APIs and Forge. If you extract issues and pages through the REST APIs or a Forge app and then license them, that sentence may apply. The terms do not mention AI training. A site backup taken from the admin interface sits under the Customer Agreement instead. Treat API extraction as **unclear** and ask counsel which route fits your case. ## Which Atlassian plan and admin rights do you need? Site backups need an admin, and Confluence exports depend on space permissions. - Site or organization admin for Jira and Confluence backups - Space admin for full space exports - 48 hours between backups, or leave attachments out to start a new one sooner, as Atlassian's tracker describes - A check that your organization admin has not blocked exports by classification level ## What personal data is in a Jira and Confluence export? Jira and Confluence hold reporter and assignee names, comments, mentions, meeting notes, HR pages and incident write-ups that name people. Jira Service Management projects add requests written by customers. ### The US position In the US, start with California. The CCPA defines a sale as making personal information available "for monetary or other valuable consideration" (Cal. Civ. Code § 1798.140(ad)(1)), and a license fee from an AI buyer fits that wording on its face. Employee and business-contact data have been in scope since January 1, 2023, when the temporary exemptions expired. Data counts as deidentified under § 1798.140(m) only if you take reasonable measures so it "cannot be associated" with a person, publicly commit to keep it that way and contractually bind every recipient. Our [de-identification guide](https://sellmydatatoai.net/guides/de-identification-for-ai-training-data) explains how to meet that standard, and our [guide to the CCPA and state privacy laws](https://sellmydatatoai.net/guides/gdpr-and-selling-data-for-ai-training) covers the other states. Other comprehensive state privacy laws, including those in Virginia, Colorado and Texas, define sales and exemptions in their own words, and several treat employee data differently from California. Map where the people in your export live before you rely on any one state's rules. If the export could hold health information from a HIPAA covered entity or business associate, HHS recognizes two de-identification methods under 45 CFR 164.514(b): Expert Determination, and Safe Harbor, which removes 18 types of identifiers. Financial institutions under the Gramm-Leach-Bliley Act must explain customers' right to opt out of certain sharing with nonaffiliated third parties, according to the FTC. Your own privacy promises still bind you. FTC staff wrote on February 13, 2024 that adopting more permissive data uses, such as AI training, through a "surreptitious, retroactive amendment" to terms or a privacy policy could be unfair or deceptive. Check the privacy notice, employee handbook and customer contracts in force when the data was collected. Workplace messages raise a labor law point too. Daniel Goldberg of Frankfurt Kurnit Klein & Selz wrote in October 2026 that staff messages about pay and working conditions can be "protected concerted activity under Section 7 of the National Labor Relations Act," whether or not staff are unionized. ### If you hold UK or EU data UK GDPR and EU GDPR treat names, email addresses and message content about identifiable people as personal data. Licensing it for AI training is a new purpose, so you need a lawful basis under Article 6 and a compatibility assessment under Article 6(4), which the ICO covers in its guidance on compatibility and the reuse of personal information. This page is general information, so confirm your position with your own counsel. ## What third-party content is in a Jira or Confluence export? Jira Service Management portals, guest access to Confluence and pages that embed client documents all bring outside content into your site. Data stored by Marketplace apps may sit under the app vendor's own terms. Exclude customer-facing projects unless your customer terms allow reuse. Buyers of [support ticket data](https://sellmydatatoai.net/buy-ai-training-data/support-ticket-data) will ask how you cleared them. ## How do you prepare a licensable Atlassian export? Preparing a Atlassian export for a buyer starts with the extraction route and ends with a manifest. Work through these steps in order. 1. **Take the site backup**: Run a Jira and Confluence backup with attachments, and plan around the 48-hour limit. 2. **Export Confluence by space**: Export spaces as XML or HTML and log which spaces you left out. 3. **Hold off on API extraction**: Do not pull data through the REST APIs or Forge for a license until counsel reviews section 9.2 of the Developer Terms. 4. **Remove third-party content**: Take out customer-facing service desk requests, guest content and client documents unless the other party has agreed in writing, and keep privileged legal material out entirely. 5. **De-identify and test**: Replace names, user IDs and email addresses across the Jira and Confluence export, then run a re-identification test on a random sample, as our [de-identification guide](https://sellmydatatoai.net/guides/de-identification-for-ai-training-data) describes. 6. **Write the manifest**: Record record counts, date ranges, systems, exclusions and the export method in a [data manifest](https://sellmydatatoai.net/guides/how-to-build-a-data-manifest) that matches what you deliver. 7. **Get counsel's sign-off**: Ask your own counsel to review the Jira and Confluence terms, your order form and your privacy notices together before any buyer sees a sample. If you want a view on whether your Atlassian data is licensable and what buyers might pay, start with a [data valuation](https://sellmydatatoai.net/data-valuation). We are a broker, not a law firm, so take independent legal advice before you sign any license. ## Frequently asked questions ### Can I export all of Confluence at once? Confluence space exports work space by space, and site admins exporting CSV or XML get all content in a space, including pages other users cannot see. A Jira and Confluence Cloud site backup covers the whole site and can include attachments, avatars and logos. Atlassian limits site backups to one every 48 hours, so plan the timing before a deadline. ### Does the Atlassian ban on selling End User Data apply to my own backup? It is unclear. Section 9.2 of the Atlassian Developer Terms says you may not sell any End User Data, and the definition covers data processed by you or your app in connection with the Atlassian Platform, which includes its APIs. A site backup taken from the admin interface falls under the Customer Agreement instead. Ask your own counsel how each route applies to your plan. ### How often can I back up Jira Cloud? Atlassian's public issue tracker records a limit of one Jira Cloud site backup every 48 hours, and cloud admins cannot reset the timer. Leaving attachments, avatars and logos out of a backup is the documented workaround if you need a new backup sooner. For a licensing project, take one full backup with attachments and work from that copy. ### Does Atlassian claim rights in my Jira data? No. Section 13 of the Atlassian Customer Agreement, effective October 1, 2026, says "Customer owns all intellectual property and other rights in Customer Data." Atlassian processes Customer Data under its Data Processing Addendum to provide the products, and AI offerings run under separate AI terms. Ownership against Atlassian still leaves your customers' and staff's rights to check. ## Sources - [Atlassian Customer Agreement](https://www.atlassian.com/legal/atlassian-customer-agreement), Atlassian, accessed November 2026 - [Atlassian Developer Terms](https://developer.atlassian.com/platform/marketplace/atlassian-developer-terms/), Atlassian Developer, accessed November 2026 - [Export content to Word, PDF, HTML and XML](https://support.atlassian.com/confluence-cloud/docs/export-content-to-word-pdf-html-and-xml/), Atlassian Support, accessed November 2026 - [Allow Site Backups to be Taken More Frequently than every 48hrs (JRACLOUD-73531)](https://jira.atlassian.com/browse/JRACLOUD-73531), Atlassian, accessed November 2026 - [California Consumer Privacy Act of 2018, Civil Code section 1798.140](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf), California Privacy Protection Agency, accessed November 2026 - [California Consumer Privacy Act employee and B2B exemptions expire January 1, 2023](https://www.morganlewis.com/pubs/2022/10/california-consumer-privacy-act-employee-and-b2b-exemptions-expire-january-1-2023), Morgan Lewis, accessed November 2026 - [AI (and other) Companies: Quietly Changing Your Terms of Service Could Be Unfair or Deceptive](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive), Federal Trade Commission, accessed November 2026 - [Guidance Regarding Methods for De-identification of Protected Health Information](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html), U.S. Department of Health and Human Services, accessed November 2026 - [Gramm-Leach-Bliley Act](https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act), Federal Trade Commission, accessed November 2026 - [Selling Company Data for AI Training: What to Know Before You Say Yes](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes), Frankfurt Kurnit Klein & Selz, accessed November 2026 - [Compatibility and the reuse of personal information](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/compatibility-and-the-reuse-of-personal-information/), Information Commissioner's Office, accessed November 2026 - [Regulation (EU) 2016/679 (General Data Protection Regulation)](https://eur-lex.europa.eu/eli/reg/2016/679/oj), EUR-Lex, accessed November 2026 --- Get a data valuation: https://sellmydatatoai.net/data-valuation