--- title: Vetting Marketplace Apps Before Data Center Goes Read-Only description: Data Center goes read-only on March 28, 2029. Vet every Jira Marketplace app on security, data residency, migration path and permissions before you move. image: https://www.catapultlabs.com/hubfs/vetting-marketplace-apps-data-center-end-of-life-featured-image-2.png --- [![logo](https://www.catapultlabs.com/hubfs/Site/Clients/Colors=True%2c%20Format=Horizontal.svg)](https://www.catapultlabs.com) Menu - ###### Products ![](https://www.catapultlabs.com/hubfs/Site/Navbar/Vector%20(Stroke).svg) Team productivity![](https://www.catapultlabs.com/hubfs/Site/Navbar/arrow-right-2.svg) - [![](https://www.catapultlabs.com/hubfs/Site/Navbar/Retros-2.svg)Agile Retros](https://www.catapultlabs.com/retrospectives) - [![](https://www.catapultlabs.com/hubfs/Site/Navbar/Scrumpoker.svg)Scrum Poker](https://marketplace.atlassian.com/apps/1218960/scrumpoker-estimates-for-jira?hosting=cloud&tab=overview) - [![](https://www.catapultlabs.com/hubfs/Site/Navbar/TeamPulse-1.svg)TeamPulse](https://marketplace.atlassian.com/apps/1227873/teampulse-health-check-ins-for-jira?tab=overview&hosting=cloud) - [![](https://www.catapultlabs.com/hubfs/Site/Navbar/bot-1.svg)StandBot](https://marketplace.atlassian.com/apps/1217825/standbot-slack-stand-up-bot-for-jira?hosting=server&tab=overview) Customer support![](https://www.catapultlabs.com/hubfs/Site/Navbar/arrow-right-2.svg) - [![](https://www.catapultlabs.com/hubfs/Site/Navbar/Sync-Jan-24-2023-05-14-14-9110-PM.svg)Freshdesk + Trello](https://www.freshworks.com/apps/freshdesk/trello) - [![](https://www.catapultlabs.com/hubfs/Site/Navbar/Sync-Jan-24-2023-05-09-14-4164-PM.svg)Freshservice + Trello](https://www.freshworks.com/apps/freshservice/trello) - ###### Solutions New![](https://www.catapultlabs.com/hubfs/Site/Navbar/Vector%20(Stroke).svg) Team productivity![](https://www.catapultlabs.com/hubfs/Site/Navbar/arrow-right-2.svg) - [![](https://www.catapultlabs.com/hubfs/Site/Navbar/devex-icon.svg)DevEx New](https://www.catapultlabs.com/solutions/devex) - ###### Platforms![](https://www.catapultlabs.com/hubfs/Site/Navbar/Vector%20(Stroke).svg) ![](https://www.catapultlabs.com/hubfs/Site/Navbar/atlassian%20logo.svg)Atlassian - [![](https://www.catapultlabs.com/hubfs/Site/Navbar/Retros-2.svg)Agile Retros](https://www.catapultlabs.com/agile-retrospectives-for-jira-and-confluence) - [![](https://www.catapultlabs.com/hubfs/Site/Navbar/Scrumpoker.svg)Scrum Poker](https://marketplace.atlassian.com/apps/1218960/scrumpoker-estimates-for-jira?hosting=cloud&tab=overview) - [![](https://www.catapultlabs.com/hubfs/Site/Navbar/TeamPulse-1.svg)TeamPulse](https://marketplace.atlassian.com/apps/1227873/teampulse-health-check-ins-for-jira?tab=overview&hosting=cloud) - [![](https://www.catapultlabs.com/hubfs/Site/Navbar/bot-1.svg)StandBot](https://marketplace.atlassian.com/apps/1217825/standbot-slack-stand-up-bot-for-jira?hosting=server&tab=overview) ![](https://www.catapultlabs.com/hubfs/Site/Navbar/Trello.svg)Trello - [![](https://www.catapultlabs.com/hubfs/Site/Navbar/Retros-1.svg)Agile Retros](https://trello.com/power-ups/61f7eba5e29fd13c6884a214/agile-retrospectives) ![](https://www.catapultlabs.com/hubfs/Site/Navbar/Monday.svg)monday.com - [![](https://www.catapultlabs.com/hubfs/Site/Navbar/Retros-2.svg)Agile Retros](https://monday.com/marketplace/124) ![](https://www.catapultlabs.com/hubfs/Site/Navbar/Slack.svg)Slack - [![](https://www.catapultlabs.com/hubfs/Site/Navbar/bot-1.svg)StandBot](https://marketplace.atlassian.com/apps/1217825/standbot-slack-stand-up-bot-for-jira?hosting=server&tab=overview) ![](https://www.catapultlabs.com/hubfs/Site/Navbar/Freshworks.svg)Freshworks - [![](https://www.catapultlabs.com/hubfs/Site/Navbar/Sync-2.svg)Freshdesk + Trello](https://www.freshworks.com/apps/freshdesk/trello) - [![](https://www.catapultlabs.com/hubfs/Site/Navbar/Sync-3.svg)Freshservice + Trello](https://www.freshworks.com/apps/freshservice/trello) - ###### Resources![](https://www.catapultlabs.com/hubfs/Site/Navbar/Vector%20(Stroke).svg) - [![](https://www.catapultlabs.com/hs-fs/hubfs/Site/Navbar/Book.png?width=24&height=24&name=Book.png)Help center](https://help.catapultlabs.com/) - [![](https://www.catapultlabs.com/hubfs/Site/Navbar/Opened-Book.svg)Blog](https://www.catapultlabs.com/blog) - [![](https://www.catapultlabs.com/hubfs/Site/Navbar/devex-icon.svg)Jira DevEx Guide](https://www.catapultlabs.com/guide/developer-experience-jira) - [![](https://www.catapultlabs.com/hs-fs/hubfs/Site/Navbar/phone-calling.webp?width=24&height=24&name=phone-calling.webp)Contact Us](https://www.catapultlabs.com/contact) - [Atlassian Marketplace](https://marketplace.atlassian.com/vendors/1213059/catapult-labs-llc) - ![](https://www.catapultlabs.com/hs-fs/hubfs/Site/Navbar/Menu-Mobile.png?width=622&height=312&name=Menu-Mobile.png) StandBot for Slack Stop worrying about your stand-up logistics! [Get it here](https://marketplace.atlassian.com/apps/1217825/standbot-slack-stand-up-bot-for-jira?hosting=server&tab=overview) [Atlassian Marketplace](https://marketplace.atlassian.com/vendors/1213059/catapult-labs-llc) Team productivity![](https://www.catapultlabs.com/hubfs/Site/Navbar/arrow-right-Apr-12-2023-05-19-56-2589-AM.svg) Customer support![](https://www.catapultlabs.com/hubfs/Site/Navbar/arrow-right-Apr-12-2023-05-19-56-2589-AM.svg) [![](https://www.catapultlabs.com/hubfs/Site/Navbar/Retros-3.svg) Agile Retros Run engaging retrospectives inside Jira, Confluence, monday.com & Trello](https://www.catapultlabs.com/retrospectives) [![](https://www.catapultlabs.com/hubfs/Site/Navbar/TeamPulse-1.svg) TeamPulse Build trust among your team by running health check-ins in Jira](https://marketplace.atlassian.com/apps/1227873/teampulse-health-check-ins-for-jira?tab=overview&hosting=cloud) [![](https://www.catapultlabs.com/hubfs/Site/Navbar/bot-1.svg) StandBot Keep your team in sync with asynchronous stand-ups in Slack](https://marketplace.atlassian.com/apps/1217825/standbot-slack-stand-up-bot-for-jira?hosting=server&tab=overview) [![](https://www.catapultlabs.com/hubfs/Site/Navbar/Scrumpoker.svg) Scrum Poker Estimate development tasks playing Planning Poker in Jira or Confluence](https://marketplace.atlassian.com/apps/1218960/scrumpoker-estimates-for-jira?hosting=cloud&tab=overview) [![](https://www.catapultlabs.com/hubfs/Site/Navbar/Sync-Jan-24-2023-05-14-14-9110-PM.svg) Freshdesk + Trello Keep your support teams in sync by linking Freshdesk tickets to Trello cards](https://www.freshworks.com/apps/freshdesk/trello) [![](https://www.catapultlabs.com/hubfs/Site/Navbar/Sync-Jan-24-2023-05-09-14-4164-PM.svg) Freshservice + Trello Empower your IT teams to collaborate by linking Freshservice tickets to Trello cards](https://www.freshworks.com/apps/freshservice/trello) ![](https://www.catapultlabs.com/hs-fs/hubfs/Site/Navbar/robot%20logo.png?width=481&height=271&name=robot%20logo.png) StandBot for Slack Stop worrying about your stand-up logistics! [Get it here![](https://www.catapultlabs.com/hubfs/Site/Navbar/arrow-right-Apr-12-2023-05-19-56-2589-AM.svg)](https://marketplace.atlassian.com/apps/1217825/standbot-slack-stand-up-bot-for-jira?hosting=server&tab=overview) ![](https://www.catapultlabs.com/hubfs/Site/Navbar/atlassian%20logo.svg)Atlassian [![](https://www.catapultlabs.com/hubfs/Site/Navbar/Retros-3.svg) Agile Retros Run engaging retrospective sessions inside Jira or Confluence](https://www.catapultlabs.com/agile-retrospectives-for-jira-and-confluence) [![](https://www.catapultlabs.com/hubfs/Site/Navbar/TeamPulse-1.svg) TeamPulse Build trust among your team by running health check-ins in Jira](https://marketplace.atlassian.com/apps/1227873/teampulse-health-check-ins-for-jira?tab=overview&hosting=cloud) [![](https://www.catapultlabs.com/hubfs/Site/Navbar/Scrumpoker.svg) Scrum Poker Estimate development tasks playing Planning Poker in Jira or Confluence](https://marketplace.atlassian.com/apps/1218960/scrumpoker-estimates-for-jira?hosting=cloud&tab=overview) [![](https://www.catapultlabs.com/hubfs/Site/Navbar/bot-1.svg) StandBot Keep your team in sync with asynchronous stand-ups in Slack](https://marketplace.atlassian.com/apps/1217825/standbot-slack-stand-up-bot-for-jira?hosting=server&tab=overview) StandBot for Slack Stop worrying about your stand-up logistics! - ![](https://www.catapultlabs.com/hs-fs/hubfs/Site/Standbot%20LP/checkmark-1.png?width=24&height=24&name=checkmark-1.png)Products Updates - ![](https://www.catapultlabs.com/hs-fs/hubfs/Site/Standbot%20LP/checkmark-1.png?width=24&height=24&name=checkmark-1.png)Get immediate notifications on blockers - ![](https://www.catapultlabs.com/hs-fs/hubfs/Site/Standbot%20LP/checkmark-1.png?width=24&height=24&name=checkmark-1.png)Export your stand-up data as CSV [Get it here![](https://www.catapultlabs.com/hubfs/Site/Navbar/arrow-right-Apr-12-2023-05-19-56-2589-AM.svg)](https://marketplace.atlassian.com/apps/1217825/standbot-slack-stand-up-bot-for-jira?hosting=server&tab=overview) ![](https://www.catapultlabs.com/hs-fs/hubfs/Site/Navbar/robot%20logo.png?width=481&height=271&name=robot%20logo.png) ![](https://www.catapultlabs.com/hubfs/Site/Navbar/Trello.svg)Trello [![](https://www.catapultlabs.com/hubfs/Site/Navbar/Sync-Jan-24-2023-05-09-14-4164-PM.svg) Agile Retros Run engaging retrospective sessions inside Trello](https://trello.com/power-ups/61f7eba5e29fd13c6884a214/agile-retrospectives) ![](https://www.catapultlabs.com/hubfs/Site/Navbar/Monday.svg) monday.com [![](https://www.catapultlabs.com/hubfs/Site/Navbar/Retros-3.svg) Agile Retros Run engaging retrospective sessions inside Jira or Confluence](https://monday.com/marketplace/124) ![](https://www.catapultlabs.com/hubfs/Site/Navbar/Slack.svg) Slack [![](https://www.catapultlabs.com/hubfs/Site/Navbar/bot-1.svg) StandBot Keep your team in sync with asynchronous stand-ups in Slack](https://marketplace.atlassian.com/apps/1217825/standbot-slack-stand-up-bot-for-jira?hosting=server&tab=overview) ![](https://www.catapultlabs.com/hubfs/Site/Navbar/Freshworks.svg)Freshworks [![](https://www.catapultlabs.com/hubfs/Site/Navbar/Sync-Jan-24-2023-05-14-14-9110-PM.svg) Freshdesk + Trello Tips & tricks on everything Agile related, remote teams, and all their possibilities](https://www.freshworks.com/apps/freshdesk/trello) [![](https://www.catapultlabs.com/hubfs/Site/Navbar/Sync-Jan-24-2023-05-09-14-4164-PM.svg) Freshservice + Trello Empower your IT teams to collaborate by linking Freshservice tickets to Trello cards](https://www.freshworks.com/apps/freshservice/trello) [![](https://www.catapultlabs.com/hs-fs/hubfs/Site/Navbar/Book.png?width=24&height=24&name=Book.png) Help center Learn how to install, set up, and use our different products](https://help.catapultlabs.com/) [![](https://www.catapultlabs.com/hubfs/Site/Navbar/Opened-Book.svg) Blog Tips & tricks on everything Agile related, remote teams, and all their possibilities](https://www.catapultlabs.com/blog) [![](https://www.catapultlabs.com/hubfs/Site/Navbar/devex-icon.svg) Jira DevEx Guide The ultimate DevEx guide for Agile teams](https://www.catapultlabs.com/guide/developer-experience-jira) [![](https://www.catapultlabs.com/hs-fs/hubfs/Site/Navbar/phone-calling.webp?width=24&height=24&name=phone-calling.webp) Contact Us](https://www.catapultlabs.com/contact) Team productivity![](https://www.catapultlabs.com/hubfs/Site/Navbar/arrow-right-Apr-12-2023-05-19-56-2589-AM.svg) [![](https://www.catapultlabs.com/hubfs/Site/Navbar/devex-icon.svg) DevEx New A suite of apps designed to revive scattered, disengaged Agile rituals](https://www.catapultlabs.com/solutions/devex) [![](https://www.catapultlabs.com/hubfs/Site/arrow-left.svg) Return to Blog](https://www.catapultlabs.com/blog) Agile Retrospectives # Vetting Marketplace Apps Before You Move to Cloud: A Jira Admin's Checklist 17 min read 15 October, 2026 ![Luis Ortiz](https://www.catapultlabs.com/hubfs/Luis%20Ortiz%20headshot.png) [Luis Ortiz](https://www.catapultlabs.com/blog/author/luis-ortiz) Table of Content [Agile Retrospectives](https://www.catapultlabs.com/blog/tag/agile-retrospectives) [Jira Admin](https://www.catapultlabs.com/blog/tag/jira-admin) [Jira Governance](https://www.catapultlabs.com/blog/tag/jira-governance) [Jira Cloud Migration](https://www.catapultlabs.com/blog/tag/jira-cloud-migration) [Data Center End of Life](https://www.catapultlabs.com/blog/tag/data-center-end-of-life) [Migration Assurance](https://www.catapultlabs.com/blog/tag/migration-assurance) [Atlassian Cloud](https://www.catapultlabs.com/blog/tag/atlassian-cloud) [Data Residency](https://www.catapultlabs.com/blog/tag/data-residency) [Marketplace Apps](https://www.catapultlabs.com/blog/tag/marketplace-apps) [Cloud Fortified](https://www.catapultlabs.com/blog/tag/cloud-fortified) Share this [![Share on linkedin](https://www.catapultlabs.com/hubfs/Site/Blogs/linkedin-default.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.catapultlabs.com%2Fblog%2Fvetting-marketplace-apps-data-center-end-of-life%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://www.catapultlabs.com/hubfs/Site/Blogs/twitter-default.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fwww.catapultlabs.com%2Fblog%2Fvetting-marketplace-apps-data-center-end-of-life%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fwww.catapultlabs.com%2Fblog%2Fvetting-marketplace-apps-data-center-end-of-life%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on facebook](https://www.catapultlabs.com/hubfs/Site/Blogs/facebook-default.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fwww.catapultlabs.com%2Fblog%2Fvetting-marketplace-apps-data-center-end-of-life%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on youtube](https://www.catapultlabs.com/hubfs/Site/Blogs/youtube-default.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.catapultlabs.com%2Fblog%2Fvetting-marketplace-apps-data-center-end-of-life%3Futm_medium%3Dsocial%26utm_source%3Dyoutube) ### Join our newsletter The best collaborative work insights. ![Newsletter](https://www.encora.com/hubfs/Catapult-Labs-site/Newsletter.png) [Agile Retrospectives](https://www.catapultlabs.com/blog/tag/agile-retrospectives) [Jira Admin](https://www.catapultlabs.com/blog/tag/jira-admin) [Jira Governance](https://www.catapultlabs.com/blog/tag/jira-governance) [Jira Cloud Migration](https://www.catapultlabs.com/blog/tag/jira-cloud-migration) [Data Center End of Life](https://www.catapultlabs.com/blog/tag/data-center-end-of-life) [Migration Assurance](https://www.catapultlabs.com/blog/tag/migration-assurance) [Atlassian Cloud](https://www.catapultlabs.com/blog/tag/atlassian-cloud) [Data Residency](https://www.catapultlabs.com/blog/tag/data-residency) [Marketplace Apps](https://www.catapultlabs.com/blog/tag/marketplace-apps) [Cloud Fortified](https://www.catapultlabs.com/blog/tag/cloud-fortified) ⚡ Quick Answer How do you vet Marketplace apps before Data Center goes read-only? Check four things for every app: its security program (Cloud Fortified until December 31, 2026, then Atlassian Enterprise Certified or Runs on Atlassian), where its data lives, its migration path in the Cloud Migration Assistant, and the permissions it asks for. Then give IT one page per app. - For most teams the real app deadline is March 30, 2028, not 2029. - Vetting Marketplace apps starts with the ones your teams use every sprint, not only the ones IT already tracks. - Badges change. Ask vendors about the practices behind them. Jira Data Center goes read-only on March 28, 2029. Most migration plans treat that date as the deadline and Jira itself as the project. The part that stalls is usually smaller and closer to the team: the Marketplace apps people use every sprint. Vetting Marketplace apps for Cloud comes down to four questions per app, answered in writing before anyone in IT asks them. Below, we map the Jira Data Center end of life dates that matter for apps, walk through the four checks, run them on one of our own apps, and finish with a one-page case you can hand to whoever approves the move. ## **What Changes for Marketplace Apps Before Data Center Goes Read-Only?** Atlassian's [Data Center end of life timeline](https://www.atlassian.com/licensing/data-center-end-of-life) has three dates, and only one of them is the read-only date. Here's what each one means for your apps: Jira Data Center end of life The three dates that matter for your Marketplace apps 1. March 30, 2026 Passed **New customers** can no longer buy Data Center subscriptions or Data Center Marketplace apps. 2. March 30, 2028 The real app deadline **Existing customers** can no longer buy new Data Center apps, subscriptions or expansions. Your app list is locked. 3. March 28, 2029 End of life Subscriptions and their Marketplace apps **expire**. Data Center goes **read-only**. Source: [Atlassian, Data Center End of Life](https://www.atlassian.com/licensing/data-center-end-of-life)   For most teams, the real app deadline is March 30, 2028. After it, a team that grows past its user tier, or needs one more app on Data Center, has no way to buy it. Atlassian also says it will offer extended maintenance after March 28, 2029 only by exception, and it advises against keeping a read-only instance connected to the internet. Neither is a plan you want to depend on. ## **Why Does App Vetting Stall Cloud Migrations?** Most admins start a Cloud migration with the apps they know best: single sign-on, service desk add-ons, reporting. The apps teams open every sprint, like retrospective boards, [estimation apps like Scrum Poker for Jira](https://marketplace.atlassian.com/apps/1218960/scrumpoker-estimates-for-jira?hosting=cloud&tab=overview&utm_source=catapult-blog&utm_medium=referral&utm_campaign=2026-q4-vetting-marketplace-apps&utm_content=h2-app-vetting-stalls) and standup bots, usually get reviewed last, a few weeks before cutover. That's when the review stalls. The Scrum Master who picked the app gets a security questionnaire with a week's notice, and the questions are the ones nobody prepared for: Where does the app store our data? What can it read and change? Will our history come with us? If the answers aren't ready, the app is dropped, or the migration date slips while everyone waits for the vendor. The fix is to vet every app on the same short list of questions, early, while you can still buy and expand on Data Center. ## **The 4-Point Checklist for Vetting Marketplace Apps for Cloud** **Marketplace app vetting** is the review a Jira admin runs on each Data Center app before moving to Cloud: confirming the app has a Cloud version and a migration path, checking the vendor's security program and data residency, and reviewing the permissions the Cloud app requests. The result is a keep, replace or retire decision IT can approve. Start with an inventory. The Jira Cloud Migration Assistant has an [Assess your apps](https://support.atlassian.com/migration/docs/assess-apps-with-the-jira-cloud-migration-assistant/) screen that lists every app installed on your Data Center instance, with its Cloud availability, its migration path and, if you install the App Usage for Jira app, how much each one is used. Mark each app *Needed in cloud*, *Not needed in cloud* or *Choose alternative*. Then run the four checks below on every app you marked as needed. ### **1. Security program: what does the vendor commit to?** Every Cloud app on the Marketplace has to meet Atlassian's baseline security requirements. On top of that, [Atlassian runs trust programs](https://www.atlassian.com/trust/marketplace) that tell you more about the vendor: - **Cloud Fortified**: the vendor runs a bug bounty, meets reliability requirements and offers 24/5 critical support. Atlassian stopped taking new Cloud Fortified submissions on September 1, 2026 and [retires the program on December 31, 2026](https://developer.atlassian.com/platform/marketplace/changelog/). - **Atlassian Enterprise Certified**: the new enterprise badge, launched October 1, 2026 for eligible Forge apps. It covers security, reliability, privacy, accessibility and responsible AI use. - **Runs on Atlassian**: the app runs on Atlassian's own infrastructure. More on this in the next check. A badge is a shortcut, not the answer. Ask what the badge stood for. **Ask the vendor:** Which trust program are you in today, and what's your plan once Cloud Fortified retires? ### **2. Data residency: where does the app store your data?** Cloud apps store data in one of two places. [Runs on Atlassian](https://www.atlassian.com/blog/development/runs-on-atlassian-now-available) apps use only Atlassian-hosted compute and storage, offer data residency in the same regions as Atlassian's own products, and let you control or block any data that leaves. Every other app stores some data on the vendor's own infrastructure, which is fine, but then the answers come from the vendor: which region, encrypted how, and processed by which subprocessors. Each listing's Privacy & Security tab covers data processing, storage, retention and certifications. Read it first, then ask for what's missing. **Ask the vendor:** Where is our data stored, in which region, and can it stay in ours? ### **3. Migration path: will the app and its data come with you?** The Cloud Migration Assistant labels each app's Marketplace app migration path: | Path type | What it means | | --- | --- | | Automated | The vendor built a path into the Migration Assistant. Stage 2 apps have high success rates; Stage 1 apps have unknown or low ones. | | View path | The vendor has its own migration method outside the Migration Assistant. | | Install-only | The app's data lives in standard Jira data, so you only install the Cloud app. | | Upgrade app | A Cloud version exists, but your Data Center version is too old. Upgrade, then reassess. | | Contact vendor | A Cloud version exists, but the vendor probably hasn't built a migration path yet. It also shows when the Migration Assistant can't read the app's details. | | No | There is no Cloud version of the app. | **![Jira Cloud Migration Assistant Assess your apps screen showing Agile Retrospectives for Jira as available in Cloud with an Automated path, next to another app marked Contact vendor](https://www.catapultlabs.com/hs-fs/hubfs/undefined-Oct-15-2026-12-22-43-1795-AM.png?width=2048&height=792&name=undefined-Oct-15-2026-12-22-43-1795-AM.png)***In the Assess your apps screen, Agile Retrospectives for Jira shows an Automated path. Another app shows Contact vendor: ask that vendor before you plan its move.* **Ask the vendor:** What's your migration path type, and what data doesn't come across? Once an app passes vetting, the move has its own checks, so [protect sprint and retro data during the migration itself](https://www.catapultlabs.com/blog/jira-data-center-cloud-migration-checklist). ### **4. Permissions: what can the Cloud app access?** Cloud apps ask for permissions, called scopes, when you install them, and the listing's Privacy & Security tab shows them too. Compare what the app asks for with what it needs to do: read or write, one project or every project, and whether it sends data to outside services, AI features included. The same review now applies to [AI agents running under app permissions](https://www.catapultlabs.com/blog/shadow-ai-agents-jira-governance-checklist). **Ask the vendor:** Which scopes does the Cloud app request, and why does it need each one? ## **What Does Cloud Fortified Tell You, and What Replaces It After 2026?** Here's the checklist run on one of our own apps, [Agile Retrospectives for Jira, on Cloud and Data Center](https://marketplace.atlassian.com/apps/1218860/agile-retrospectives-for-jira?hosting=cloud&tab=overview&utm_source=catapult-blog&utm_medium=referral&utm_campaign=2026-q4-vetting-marketplace-apps&utm_content=h2-intl-link-worked-example). - **Security program.** Agile Retrospectives for Jira is Cloud Fortified today and part of the Marketplace Bug Bounty program. Until December 31, 2026, that badge tells a reviewer three things: there is a bug bounty, the app meets Atlassian's reliability requirements, and critical issues get 24/5 support. Independent security researchers test the app through that bug bounty. The app already runs on Atlassian Forge, and we plan to pursue Atlassian Enterprise Certified, the badge that replaces Cloud Fortified for enterprise reviews. - **Data residency.** Agile Retrospectives isn't a Runs on Atlassian app today, so the answer comes from us, not from a badge. Retrospective content, such as ideas, action items and board configuration, is stored in MongoDB Atlas in the United States. Product analytics run through Mixpanel, also in the United States. Alongside that content, the app stores the identifiers that connect it to your Jira site, like account IDs, group IDs, and project and issue keys. If your policy requires data to stay in another region, ask us before you approve the app. - **Migration path.** The app runs on both Jira Cloud and Jira Data Center, and its migration path is Automated: Agile Retrospectives for Jira moves through the Jira Cloud Migration Assistant with your other Jira data, and Cloud Migration Assistance is part of our support. - **Permissions.** [Check the Privacy & Security tab on the Agile Retrospectives listing](https://marketplace.atlassian.com/apps/1218860/agile-retrospectives-for-jira?hosting=cloud&tab=privacy-and-security&utm_source=catapult-blog&utm_medium=referral&utm_campaign=2026-q4-vetting-marketplace-apps&utm_content=h2-cloud-fortified-example) for the scopes the Cloud app requests and every type of data it processes: your site's client key, Atlassian account and group IDs, project and issue keys, and retrospective content. **![Privacy and Security tab of the Agile Retrospectives for Jira Marketplace listing, showing the Data storage and management section and the types of end-user data the app processes](https://www.catapultlabs.com/hs-fs/hubfs/undefined-Oct-15-2026-12-22-43-7156-AM.png?width=2048&height=1105&name=undefined-Oct-15-2026-12-22-43-7156-AM.png)** *The Privacy & Security tab on the Agile Retrospectives for Jira listing lists every type of data the app processes and where it's stored.* The badge answered the first question quickly. It didn't answer the other three, and after December 31 it won't answer the first one either. That's why the checklist asks about practices, not badges: a bug bounty, a support commitment, a data location and a list of scopes stay true whatever the program is called next year. ## **How Do You Get IT to Approve a Marketplace App for Cloud?** Approvers don't need a thread of screenshots. They need one page per app that turns the review into a yes or no. Use this one: | Field | What to write | | --- | --- | | App and owner | App name, vendor, and the person on your side who owns it after the move | | Who uses it | Teams, number of users, how often (from App Usage for Jira) | | Security program | Current trust program, plus the vendor's plan after Cloud Fortified, with a link | | Data residency | Where data is stored and in which region, with a link to the vendor's answer | | Migration path | Path type from the Migration Assistant, and any data that won't come across | | Permissions | Scopes the Cloud app requests, and whether each one is needed | | Decision | KeepReplaceRetire | | Fallback | What the team uses if the app fails review | Fill it in with the team that uses the app, not only with the vendor. The champion knows why the team chose the app, and the admin knows what IT will ask. Together, the page takes about twenty minutes. ## **Start App Vetting Now, Not in 2028** March 28, 2029 is when Data Center goes read-only. March 30, 2028 is when your app list stops changing. Vetting Marketplace apps before then means every app your teams rely on arrives in Cloud with an owner, an answer for IT and a plan for its data. Badges will keep changing. The four questions won't, so ask them now, while you still have room to choose. ## **Frequently Asked Questions** What changes for Marketplace apps before Data Center goes read-only? After March 30, 2028, existing customers can no longer buy new Data Center Marketplace apps or expand their subscriptions. On March 28, 2029, Data Center subscriptions and their associated Marketplace apps expire and the products become read-only. Renewals are prorated to that date, so plan your app decisions well before 2028. Why does app vetting stall Cloud migrations? Admins usually review the platform-level apps first and the apps teams use every sprint last, close to cutover. Those reviews then stall on questions nobody prepared for: where the app stores its data, what it can access, and whether it has a migration path. Vetting those apps early removes the surprise. What should a Jira admin check when vetting Marketplace apps for Cloud? Check four things for every app you need in Cloud: the vendor's security program, where the app stores its data, the migration path the Jira Cloud Migration Assistant reports, and the permissions the Cloud app requests. Put each answer in writing and ask the vendor directly when the Marketplace listing doesn't answer it. What does Cloud Fortified tell you, and what replaces it after 2026? Cloud Fortified tells you the vendor runs a bug bounty, meets reliability requirements and offers 24/5 critical support. Atlassian closed new submissions on September 1, 2026 and retires the badge on December 31, 2026. Atlassian Enterprise Certified, launched October 1, 2026 for Forge apps, is the new enterprise badge, and Runs on Atlassian covers apps that keep data on Atlassian. How do you get IT to approve a Marketplace app for Cloud? Give IT one page per app: who owns it, who uses it and how often, the four checklist answers with links to the evidence, the migration path type, and a clear decision to keep, replace or retire it. Add a fallback in case the app fails review, so the approval is a yes or no, not a research task. [See It In Action: Book a 15-Minute Demo](https://calendar.google.com/calendar/appointments/schedules/AcZssZ0ODMQxF98E1DkwDIF8FXT4Ja_E4Wj8JL3QIT5NhrViiMBdoJK0ZQNxc03c6uAmcn-ewMjScsaq) ![Luis Ortiz](https://www.catapultlabs.com/hubfs/Luis%20Ortiz%20headshot.png) Luis Ortiz Luis is the Co-Founder and leads Growth at Catapult Labs. He writes about practical Agile workflows across Jira, Confluence, and Slack, helping teams run better stand-ups, retrospectives, and improve productivity without meeting overload. [![](https://www.catapultlabs.com/hubfs/Site/Footer/linkedin.png)](https://www.linkedin.com/in/luis-ortiz-23a4a482/) #### You might also like [![logo](https://www.catapultlabs.com/hs-fs/hubfs/Site/Footer/Colors=True%2c%20Format=Horizontal%20(1).png?width=200&height=48&name=Colors=True%2c%20Format=Horizontal%20(1).png)](https://www.catapultlabs.com) [![balloon-1](https://www.catapultlabs.com/hubfs/Site/Footer/balloon-1.svg)](https://www.catapultlabs.com/contact) Products [Agile Retros](https://marketplace.atlassian.com/apps/1218860/agile-retrospectives-for-jira?hosting=datacenter&tab=overview) [Scrum Poker](https://marketplace.atlassian.com/apps/1218960/scrumpoker-estimates-for-jira?hosting=cloud&tab=overview) [TeamPulse](https://marketplace.atlassian.com/apps/1227873/teampulse-health-check-ins-for-jira?tab=overview&hosting=cloud) [StandBot](https://marketplace.atlassian.com/apps/1217825/standbot-slack-stand-up-bot-for-jira?hosting=server&tab=overview) [Freshdesk + Trello](https://www.freshworks.com/apps/freshdesk/trello) [Freshservice + Trello](https://www.freshworks.com/apps/freshservice/trello) [Blog](https://www.catapultlabs.com/blog) [Help center](https://help.catapultlabs.com/) [![twitter](https://www.catapultlabs.com/hs-fs/hubfs/Site/Footer/twitter.png?width=24&height=24&name=twitter.png)](https://twitter.com/CatapultLabs_) [![linkedin](https://www.catapultlabs.com/hs-fs/hubfs/Site/Footer/linkedin.png?width=24&height=24&name=linkedin.png)](https://www.linkedin.com/company/25009688/) [![youtube](https://www.catapultlabs.com/hubfs/Site/Footer/YouTube_full-color_icon.svg)](https://www.youtube.com/@catapultlabs) Products Atlassian [Agile Retros](https://marketplace.atlassian.com/apps/1218860/agile-retrospectives-for-jira?hosting=datacenter&tab=overview) [Scrum Poker](https://marketplace.atlassian.com/apps/1218960/scrumpoker-estimates-for-jira?hosting=cloud&tab=overview) [TeamPulse](https://marketplace.atlassian.com/apps/1227873/teampulse-health-check-ins-for-jira?tab=overview&hosting=cloud) [StandBot](https://marketplace.atlassian.com/apps/1217825/standbot-slack-stand-up-bot-for-jira?hosting=server&tab=overview) Trello [Agile Retros](https://trello.com/power-ups/61f7eba5e29fd13c6884a214/agile-retrospectives) Monday [Agile Retros](https://monday.com/marketplace/124) Slack [StandBot](https://marketplace.atlassian.com/apps/1217825/standbot-slack-stand-up-bot-for-jira?hosting=server&tab=overview) Freshworks [Freshdesk + Trello](https://www.freshworks.com/apps/freshdesk/trello) [Freshservice + Trello](https://www.freshworks.com/apps/freshservice/trello) [Blog](https://www.catapultlabs.com/blog) [Help center](https://help.catapultlabs.com/) [![twitter](https://www.catapultlabs.com/hs-fs/hubfs/Site/Footer/twitter.png?width=24&height=24&name=twitter.png)](https://twitter.com/CatapultLabs_) [![linkedin](https://www.catapultlabs.com/hs-fs/hubfs/Site/Footer/linkedin.png?width=24&height=24&name=linkedin.png)](https://www.linkedin.com/company/25009688/) [![youtube](https://www.catapultlabs.com/hubfs/Site/Footer/YouTube_full-color_icon.svg)](https://www.youtube.com/@catapultlabs) © 2026 Catapult Labs. All Rights Reserved [Terms](https://www.catapultlabs.com/legal?section=term_service) [EULA](https://www.catapultlabs.com/legal?section=eula) [Privacy Notice](https://www.catapultlabs.com/legal?section=global-privacy) [SLA](https://www.catapultlabs.com/legal?section=service-level) [Cookies Disclousure Policy](https://www.catapultlabs.com/legal?section=cookie-disclosure) Cookie Settings ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Luis Ortiz", "url" : "https://www.catapultlabs.com/blog/author/luis-ortiz" }, "dateModified" : "2026-10-15T01:28:37.210Z", "datePublished" : "2026-10-15T01:28:37.000Z", "headline" : "Vetting Marketplace Apps Before Data Center Goes Read-Only", "image" : [ "https://www.catapultlabs.com/hubfs/vetting-marketplace-apps-data-center-end-of-life-featured-image-2.png" ], "mainEntityOfPage" : { "@id" : "https://www.catapultlabs.com/blog/vetting-marketplace-apps-data-center-end-of-life", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.catapultlabs.com/hubfs/Site/Footer/Colors=True%2c%20Format=Horizontal%20(1).png" } } } ``` ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Luis Ortiz" }, "dateModified" : "2026-10-15T01:28:37+0000", "datePublished" : "2026-10-15T01:28:37+0000", "description" : "Data Center goes read-only on March 28, 2029. Vet every Jira Marketplace app on security, data residency, migration path and permissions before you move.", "headline" : "Vetting Marketplace Apps Before You Move to Cloud: A Jira Admin's Checklist", "image" : "https://www.catapultlabs.com/hubfs/vetting-marketplace-apps-data-center-end-of-life-featured-image-2.png", "mainEntityOfPage" : { "@id" : "https://www.catapultlabs.com/blog/vetting-marketplace-apps-data-center-end-of-life", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.catapultlabs.com/hubfs/Site/Clients/Colors=True%2c%20Format=Horizontal.svg" }, "name" : "Catapult Labs" } } ``` ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "After March 30, 2028, existing customers can no longer buy new Data Center Marketplace apps or expand their subscriptions. On March 28, 2029, Data Center subscriptions and their associated Marketplace apps expire and the products become read-only. Renewals are prorated to that date, so plan your app decisions well before 2028." }, "name" : "What changes for Marketplace apps before Data Center goes read-only?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Admins usually review the platform-level apps first and the apps teams use every sprint last, close to cutover. Those reviews then stall on questions nobody prepared for: where the app stores its data, what it can access, and whether it has a migration path. Vetting those apps early removes the surprise." }, "name" : "Why does app vetting stall Cloud migrations?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Check four things for every app you need in Cloud: the vendor's security program, where the app stores its data, the migration path the Jira Cloud Migration Assistant reports, and the permissions the Cloud app requests. Put each answer in writing and ask the vendor directly when the Marketplace listing doesn't answer it." }, "name" : "What should a Jira admin check when vetting Marketplace apps for Cloud?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Cloud Fortified tells you the vendor runs a bug bounty, meets reliability requirements and offers 24/5 critical support. Atlassian closed new submissions on September 1, 2026 and retires the badge on December 31, 2026. Atlassian Enterprise Certified, launched October 1, 2026 for Forge apps, is the new enterprise badge, and Runs on Atlassian covers apps that keep data on Atlassian." }, "name" : "What does Cloud Fortified tell you, and what replaces it after 2026?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Give IT one page per app: who owns it, who uses it and how often, the four checklist answers with links to the evidence, the migration path type, and a clear decision to keep, replace or retire it. Add a fallback in case the app fails review, so the approval is a yes or no, not a research task." }, "name" : "How do you get IT to approve a Marketplace app for Cloud?" } ] } ```