Four questions decide almost everything: where your data goes, whether the vendor is still alive, what happens when you uninstall, and what the bill looks like when the team grows. Everything else is detail. Short answer. Look for the Runs on Atlassian badge, which is a verified technical fact rather than a claim. Check the date of the latest version and whether the vendor answers reviews. Ask what uninstalling leaves behind. Then look at the price for the team size you will have next year, not the one you have today. 1. Where does the data go This is the question your security team will ask, so it is worth being able to answer it before they do. Apps on Atlassian Cloud are built on one of two platforms. Forge apps can run entirely inside Atlassian's own infrastructure. Connect apps run on the vendor's servers, which means your page content travels to a machine you know nothing about, in a country you may not have chosen. Neither is automatically wrong. A vendor's server is not evil, and plenty of good apps use one because they genuinely need to. But it is a different conversation with your compliance people, and it should be a conscious decision rather than a surprise. What the badges actually mean Badge What it tells you Runs on Atlassian The app uses only Atlassian-hosted compute and storage, matches the data residency of your product, and cannot send data outside your instance without your consent. Atlassian applies this automatically to eligible Forge apps, so nobody can simply claim it. Cloud Fortified About the vendor's practices rather than the architecture: service level objectives, incident process, a named support channel, a 24-hour response promise for critical issues, bug bounty participation. Being replaced by Atlassian Enterprise Certified, with onboarding from the third quarter of 2026 and Cloud Fortified phased out by the end of the year. No badge Not a verdict. Small vendors often skip programmes with fees and paperwork. It means you ask the questions yourself. The practical difference: Runs on Atlassian answers "can this app leak my content", Cloud Fortified answers "will anyone pick up the phone at two in the morning". Enterprises usually need both. A ten-person team almost always needs only the first. 2. Is the vendor still there Abandonment is the most common way an app hurts you, and it is quiet. Nothing breaks on the day the vendor stops caring — it breaks a year later, during a platform change, when nobody answers the ticket. Three signals, in order of usefulness: The date of the latest version. On the Marketplace listing, look at when the app was last updated. Two years of silence for an app on an evolving platform means somebody moved on. Replies to reviews. Open the reviews tab and look for vendor responses, especially to the angry ones. A vendor who answers a one-star review in public is a vendor who will answer your email. Whether it is still a Connect app. Connect apps cannot be updated after March 2026 and stop receiving fixes at the end of that year. An app still on Connect with no migration announcement is on a countdown, whatever its rating says. 3. What happens when you uninstall Ask this before installing, not after. There are two very different answers. Some apps only display what already exists in Confluence: a diagram that is an attachment on your page, a list built from your pages. Uninstalling removes the macro and leaves your content exactly as it was. The risk is a page that looks broken until somebody edits it, and nothing more. Other apps store their own data — configurations, entities, records that live only inside the app. Uninstalling takes that with it. That can be fine, as long as you know it in advance and know what export you get. It is a bad thing to discover during a licence renewal argument. 4. The price at the size you will actually be Marketplace pricing is tiered, and the tiers are not linear. An app that costs a few dollars a month for ten people can cost several hundred at a hundred and fifty. Open the pricing tab and look at the row for the team size you expect a year from now. Also check the free tier. Most apps are free for teams up to ten users, which is genuinely free rather than a trial, and that is the cheapest way to judge an app: install it, use it for a month, and decide with evidence. The questions worth sending the vendor *Disclosure:* I build four Confluence apps, and all of them carry the Runs on Atlassian badge, which is precisely why I can write this section without discomfort: the answer to the first question is no, nothing leaves your site, and it is verified by Atlassian rather than promised by me. The apps are Clickable SVG, Smart Search, Table Export and Word Import, all free for teams up to ten. Frequently asked Does a high rating mean an app is safe? It means people liked using it, which is a different question from where their data went. Ratings and trust badges answer different things, and the badge is the one your security review cares about. Can I restrict what an app is allowed to do? App permissions are declared by the app and shown at install time. Read that screen rather than clicking through it: an app asking for far more than its job needs is a signal in itself. Our security team wants a review. What do we send them? The Marketplace listing's security tab, the vendor's privacy statement, and the answer to the data egress question above. For a Runs on Atlassian app that is usually the whole review. What if the app we already use gets abandoned? Check what you are actually locked into. Apps that only render your own content leave nothing behind; apps holding their own data need an export before you switch. We wrote about the specific cases of SVG out and the Connect end of life.