Comment by egeozcan
7 hours ago
I know a lot of companies vibe-coding alternatives. I'm not an expert but it's perhaps even illegal for most European companies to migrate any customer data to Atlassian servers.
7 hours ago
I know a lot of companies vibe-coding alternatives. I'm not an expert but it's perhaps even illegal for most European companies to migrate any customer data to Atlassian servers.
This is something I keep struggling with.
If someone wants to vibe code an alternative to a SaaS tool, my gut feeling is "no, this is bad and it will blow up" as vibe-coded projects tend to do.
But then the alternative is often paying $X million per year for licenses to a half-assed program that hasn't had a UI update since 2005.
I just don't have a good argument on why they shouldn't when the outcome will be just as dogshit, only cheaper and flashier.
They just started updating the UI and I am pissed off.
I don’t want them to change UI. I have plenty of work to do and have plenty of other tools that I use daily.
I have my workflows, I am swamped with work and now I have to change my workflows because someone changed options in UI where ones that O used are not there anymore.
The argument I'd make isn't about UI or features, it's about who owns security afterwards. The vendor has people whose whole job is patching things like this Ruby regex issue. The internal vibe-coded Jira usually has nobody, and the bugs that bite are boring ones, like a project page that loads for anyone who guesses the ID.
If they go ahead anyway, the ask is just that someone actually owns it after launch, not only builds it.
Atlassian migrated EU data to EU based servers. I still had to click approve but they did that for me.
Atlassian is a US-parented company and this means that CLOUD act can affect it. Even this only can make it unsuitable. Then there are questions to data-in-transit. Also nothing is legally tested. Vibe-coding an alternative is much safer if you have sensitive customer data (even simple support tickets).
Not that this matters in terms of the CLOUD Act, but it's actually an Australian company based in Sydney.
1 reply →
The location of the servers matters only if you're trying to prevent physical access, for anything else it's completely irrelevant
Can you give more information on "illegal for most European companies" part? Asking for a EU company using Jira :)
This person is just posting absolutely baseless claims, as if Atlassian, a company that basically exists purely on the back of B2B SaaS sales, has not considered EU data residency requirements in their core product offering: https://www.atlassian.com/software/data-residency
FWIW nearly every SaaS or IaaS is making bold claims about supporting data sovereignty, but unless it has been challenged in court I wouldn’t put much stock into it.
The fact that Jira/Confluence are being processed by their LLMs puts them in direct legal conflict with several statutes in the EU, its a matter of time for them to get hit by this and I’m betting that they think the fine will be lower than the revenue they acquire for doing it- and they’re hoping they don’t get hit at all.
This seems to be the common case for a lot of the non-EU tech companies, and it seems to be working.
Oracle is currently the market leader in “sovereign” compute for EU governments for example, as ironic as that is.
> This person is just posting absolutely baseless claims
You don't need to be so hostile. I know about the EU requirements but many EU companies have sensitive data on hosted JIRA / Confluence that simply cannot be in the possession of a non-European company. I know because I'm working for one. I cannot even remote-work from outside Europe. Some stuff cannot even leave the VPN. There's also the CLOUD act.
Yeah I thought Jira at least was all built on AWS these days. I've never set up a Jira Cloud instance but I'd be surprised if you don't chose where your data lives.
In short gdpr compliant means you can configure it but it must not be compliant by default and also there is no guarantee.
They are constantly changing their software and settings. More than once they believed that something is legal but can be risky for the atlassian customer.
For example training AI on metadata which they believe are anonymized but are maybe not enough changed.
Training data or metadata permisson can not be configured on all subscriptions. But as a data processor they must follow the contract otherwise they become data controller.
Also there are risks associated with privacy data framework, cloud act etc. to be non compliant just by data transfers to other countries.
This is how SaaS dies, vibe-coded to death.
I’m doing my part!