{
  "slug": "bitbucket",
  "category": "code-hosting",
  "name": "Bitbucket",
  "description": "Git hosting service from Atlassian with pull requests, Bitbucket Pipelines CI/CD and integration with Jira and other Atlassian products.",
  "website": "https://bitbucket.org",
  "license": null,
  "platforms": [
    "web"
  ],
  "jurisdiction": {
    "code": "AU",
    "name": "Australia",
    "eyes": "Five Eyes",
    "eu": false,
    "gdpr": false,
    "cloud_act": "agreement"
  },
  "pick": false,
  "pick_reason": null,
  "disclosure": null,
  "grade": "D",
  "score": 47,
  "coverage": 100,
  "summary": "Bitbucket scores 47 out of 100 (grade D) on the code hosting criteria. It meets 3 of 8 criteria: transparency report, tells users about requests and TLS configuration. It partly meets no ads or data sales, independent audit and security headers. It does not meet open source and no trackers or telemetry. It is based in Australia: Five Eyes member; CLOUD Act data access agreement with the US. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B.",
  "url": "https://privacyratings.com/code-hosting/bitbucket/",
  "markdown": "https://privacyratings.com/code-hosting/bitbucket/index.md",
  "answers": {
    "open_source": {
      "title": "Open source",
      "weight": 3,
      "answer": "no",
      "evidence": null,
      "note": "Closed source."
    },
    "no_trackers": {
      "title": "No trackers or telemetry",
      "weight": 3,
      "answer": "no",
      "evidence": "https://www.atlassian.com/legal/privacy-policy",
      "note": "The privacy policy says Atlassian and third-party advertising and analytics partners use cookies, pixels and device identifiers."
    },
    "no_ads": {
      "title": "No ads or data sales",
      "weight": 2,
      "answer": "partial",
      "evidence": "https://www.atlassian.com/legal/privacy-policy",
      "note": "Funded by subscriptions, but the privacy policy describes targeted advertising with third-party advertising partners."
    },
    "independent_audit": {
      "title": "Independent audit",
      "weight": 2,
      "answer": "partial",
      "evidence": "https://www.atlassian.com/trust/compliance/resources/soc2",
      "note": "Bitbucket Cloud has SOC 2 reports from an independent CPA firm, available only through Atlassian's Trust Portal."
    },
    "transparency_report": {
      "title": "Transparency report",
      "weight": 2,
      "answer": "yes",
      "evidence": "https://www.atlassian.com/trust/privacy/transparency-report",
      "note": "Publishes an annual transparency report with counts of government requests for user data and content removal."
    },
    "user_notice": {
      "title": "Tells users about requests",
      "weight": 1,
      "answer": "yes",
      "evidence": "https://www.atlassian.com/trust/privacy/guidelines-for-law-enforcement",
      "note": "Policy is to notify customers of requests for their information 7 to 10 days before disclosure unless prohibited by law."
    },
    "tls": {
      "title": "TLS configuration",
      "weight": 2,
      "answer": "yes",
      "evidence": "https://www.ssllabs.com/ssltest/analyze.html?d=bitbucket.org&hideResults=on",
      "note": "Grade A+"
    },
    "security_headers": {
      "title": "Security headers",
      "weight": 1,
      "answer": "partial",
      "evidence": "https://developer.mozilla.org/en-US/observatory/analyze?host=bitbucket.org",
      "note": "Grade B (70/100+)"
    },
    "web_standards": {
      "title": "Modern web standards",
      "weight": 1,
      "answer": "pending",
      "evidence": null,
      "note": "Not tested yet."
    }
  },
  "tests": {
    "ssllabs": "A+",
    "observatory": "B",
    "internetnl_web": null,
    "internetnl_mail": null,
    "trackers": [],
    "tested_at": "2026-10-01T06:59:43.750Z"
  },
  "last_modified": "2026-10-01T07:44:20Z"
}