A practical decision guide for teams moving to Atlassian Cloud and weighing standard multi-tenant against a fully isolated environment.
If your team is moving to Atlassian Cloud, especially as part of a Data Center exit, one question will come up sooner or later: is Commercial Cloud enough, or does your team actually need Isolated Cloud?
It is easy to overcomplicate that choice. Almost every team feels its data is sensitive, so “our data is important” isn’t a useful test. Everyone passes it, and it nudges everyone toward the most locked-down option whether they need it or not.
A more useful question is this: does your organization require dedicated infrastructure, or are logical isolation, strong encryption, and data residency sufficient? This distinction helps match the right cloud tier to your actual requirements.
The three options, and why Government Cloud isn’t really in this race
Atlassian offers three cloud deployment models:
- Commercial Cloud, which is multi-tenant;
- Government Cloud, which holds FedRAMP Moderate authorization for eligible US public-sector customers;
- Isolated Cloud, a single-customer dedicated environment that reached general availability on June 29, 2026.
One point clears up a lot of confusion. Government Cloud is not the maximum-isolation tier. It’s still a multi-tenant environment, just one restricted to public-sector customers, and it doesn’t exist to solve internal “no shared cloud” policies. Its job is regulatory approval for government work, not physical isolation.
So unless you’re a US government agency, your real decision is a two-way one: Commercial Cloud or Isolated Cloud. That’s where the rest of this guide focuses.
What Commercial Cloud already gives you
Before assuming your organization needs a dedicated environment, it is worth looking closely at what Commercial Cloud already includes. The Enterprise plan in particular provides several controls that teams sometimes assume are only available with Isolated Cloud.
- Strong encryption. Atlassian encrypts data at rest with AES-256 and protects data in transit with TLS 1.2 or higher.
- Logical separation and access controls. Customer data is logically isolated, while capabilities such as single sign-on and multi-factor authentication are available through Atlassian Guard.
- Data residency. Organizations can pin data to regions including the US, EU, or Australia. The limitation is that Commercial Cloud residency generally applies to in-scope data stored at rest for more than 30 days.
- Customer-managed encryption keys. Cloud Enterprise customers can use encryption keys stored in their own AWS account. This creates cryptographic separation from other customers, and the organization can revoke Atlassian’s access to those keys whenever it chooses.
The key point: physical separation is not the only way to maintain control. Commercial Cloud already provides encryption, residency controls, and customer-managed keys that satisfy many organizations.
What Isolated Cloud adds on top
Isolated Cloud is designed for organizations whose security, compliance, or data-isolation needs go beyond standard multi-tenant cloud. The difference is not just more security, but a different infrastructure model.
Compared with Commercial Cloud, Isolated Cloud adds several specific capabilities:
- Dedicated infrastructure rather than logical separation alone. Compute, storage, and networking are dedicated to your organization within its own virtual private cloud, rather than shared with other tenants, with logical controls in place.
- A boundary for one enterprise. A single organization can operate multiple internal tenants, such as separate business units or regional subsidiaries, within the same isolated environment.
- Broader data residency. Residency extends to data in transit, so almost all user-generated content and personal data remains inside the selected region. Residency is part of the architecture itself rather than a feature that is enabled separately.
- Egress denied by default. Information does not leave the environment unless the organization explicitly allows it. Customer-managed encryption keys are also mandatory and built into the setup.
- Enterprise-level capabilities included. Isolated Cloud includes everything available in Cloud Enterprise together with Atlassian Guard Premium by default.
These benefits come with trade-offs. Atlassian has stated that Isolated Cloud is more expensive than Commercial Cloud and Government Cloud. The available Marketplace catalog is also smaller because apps must run on Forge and qualify under the “Runs on Atlassian” program. Teams should verify app availability early.
At a glance: Commercial Cloud vs Isolated Cloud
| What you’re comparing | Commercial Cloud | Isolated Cloud |
|---|---|---|
| Infrastructure | Multi-tenant: shared systems with logical separation between customers | Single-customer: dedicated compute, storage, and networking in your own VPC |
| Encryption | AES-256 at rest, TLS 1.2+ in transit | Same standards |
| Customer-managed keys | Available on the Enterprise plan (optional) | Mandatory and built in |
| Data residency | Region pinning for in-scope data at rest, generally beyond 30 days | Extends to data in transit; almost all content stays in-region by design |
| Data egress | Standard controls | Blocked by default |
| Access management | SSO and MFA via Atlassian Guard | All Cloud Enterprise features plus Atlassian Guard Premium included |
| App ecosystem | Full Marketplace | Narrower: Forge / “Runs on Atlassian” apps only |
| Relative cost | Lower | Higher (premium tier) |
| Best fit | Most teams, including many regulated ones, whose needs are met by residency, key control, and compliance certs | Teams with a hard no-shared-infrastructure mandate, in-transit residency needs, or high-value IP to protect |
The question that actually decides it
Strip away the noise, and the decision comes down to one question: does a documented requirement force you onto dedicated infrastructure, or is logical separation acceptable?
That’s the difference between a mandate and a preference.
A mandate is something written down and enforceable: a contract clause, a regulation, or an internal security policy that an auditor will hold you to. A preference is a strong wish for more control that isn’t actually required for you to operate. “Our auditor requires dedicated infrastructure in writing” is a mandate. “Leadership would feel more comfortable not sharing” is a preference.
Mandates point to Isolated Cloud. Preferences, more often than not, are already covered by Commercial Cloud.
Who genuinely needs Isolated Cloud
You’re a real Isolated Cloud candidate if any one of these is true:
- You have an explicit no-shared-infrastructure rule, where “logically separate” won’t pass an audit and someone specifically requires dedicated infrastructure.
- You need data residency to cover data in transit, not just data at rest.
- You’re protecting high-value intellectual property or safety-critical systems, and the risk clearly outweighs the higher cost.
These requirements are common in banking, healthcare, defense, critical infrastructure, and automotive R&D. However, the industry alone does not decide. The specific requirement does.
Who’s fine on Commercial Cloud
For most organizations, Commercial Cloud already meets the necessary security and control requirements. You are likely in this group if data residency, customer-managed keys, SSO, and Atlassian compliance certifications meet your requirements, with no rule requiring dedicated infrastructure.
Cost also matters. If dedicated infrastructure would be useful but is not required, paying the Isolated Cloud premium may not provide enough additional value to justify the expense.
There is no advantage in choosing the most restrictive tier simply because it exists. The better choice is the one that matches what your organization is actually required to do. For many teams, that means Commercial Cloud Enterprise.
One caveat: isolation isn’t the same as sovereignty
Here’s a distinction worth getting right, because it’s widely misunderstood. Isolated Cloud does not give you full data sovereignty.
Because Atlassian has a US legal home, it remains subject to US laws such as the CLOUD Act, which can compel disclosure of customer data even from a single-tenant Isolated Cloud environment. Isolation separates your data from other customers. It does not separate it from Atlassian’s legal obligations or from US jurisdiction.
If avoiding US legal reach is a hard requirement, discuss this with your legal and compliance teams before choosing a cloud path. Tenant isolation does not change provider jurisdiction.
Making your move, whichever tier you choose
The takeaway is simple: match the tier to your actual mandate, not to how sensitive your data feels. Write down your hard requirements first, including any no-sharing rule, the scope of your residency needs, whether you need to hold your own keys, and what your auditors demand. Then check them against what Commercial Cloud already offers. If there’s a gap, that gap is your case for Isolated Cloud. If there isn’t, you have your answer, and you can save the premium.
Whichever tier you choose, you should not have to lose the tools your team depends on. At DevSamurai, our apps are available on Commercial Cloud, and ProductGo and GanttTable are already live on Isolated Cloud, with more coming. Our goal is to help teams leaving Data Center move without losing critical workflows.
Take it one step at a time. Once you’ve matched your requirements to the right tier, the rest of the move gets much easier, and you can plan it with confidence.
If you’d like help figuring out which cloud version fits your team, or which DevSamurai apps are ready for it, reach out to us anytime. We’re happy to talk it through.
