Atlassian Statuspage vs Instatus

Atlassian Statuspage

The product is documented as a status communication service that receives signals from external monitors such as DataDog, New Relic, Librato and Pingdom, or from an email whose subject contains "UP" or "DOWN"; the synthetic-check and escalation material captured concerns the vendor's separate Opsgenie product. We found no public information on any checks, probe locations, check intervals or failure confirmation run by the product itself.

Instatus

The captured help pages document DNS A and MX record checks, TCP and UDP reachability checks with connection time, latency and packet-loss measurement, a configurable interval down to 30 seconds on paid plans, and a choice of running from the United States, Canada, Europe or Asia. Failure and recovery actions are specified (create an incident, notify subscribers, auto-resolve and update the status page). We found no public information on HTTP keyword checks, ping, SSL certificate expiry, cron or heartbeat monitoring, or on any confirmation from a second location before an alert fires — which is the false-positive control an auditor would ask me to evidence.

Atlassian Statuspage

Documented alerting is subscriber-facing: email, SMS and webhook notifications, updates piped into Slack and Microsoft Teams channels, automated Twitter posts, and an email and SMS reminder sixty minutes before scheduled maintenance. Escalation rules, on-call schedules, phone-call alerts and acknowledge flows appear only in the vendor's separate Opsgenie product, which the page integrates with to update status from the alerting app.

Instatus

Alerting spans email, SMS and phone calls by tier, chat channels including Slack, Microsoft Teams, Discord and Google Chat, signed webhooks, and bring-your-own SMS gateways such as Twilio, Esendex, Vonage, Bird and AWS SNS. On-call schedules with daily, weekly and custom rotations and time-of-day restrictions are documented through a full create, read, update and delete API, and incident escalations are listed as a paid feature. We found no public information on escalation timeouts, acknowledging or resolving from the app, alert grouping, or incident timelines showing who did what — the records I would need for detection, response and resolution evidence.

Atlassian Statuspage

This is the product's core: public, private and audience-specific pages on a custom domain with custom CSS, HTML and JS, components and component groups with per-component subscriptions, incident templates, scheduled maintenance in four states with automated subscriber notifications and tweets, embeddable widgets, SAML single sign-on for private pages, and a ninety-day per-component uptime history whose calculation formula is published. We found no public information on RSS subscriptions, additional page languages, or documentation of how the page hosting is kept separate from the vendor's main service.

Instatus

This is the product's core: components with groups, per-component uptime history and third-party dependencies such as AWS and Stripe; custom domains on paid tiers; subscribers notified by email, SMS, webhook, Slack, Teams, Discord, X, RSS and API with per-component subscription choice and signed webhook payloads. Pages can be private or audience-specific, and a private status page can be signed into with SAML single sign-on, which is exactly what I need before pointing customers at one. We found no public information on page languages, incident templates, embeddable widgets or separation of the status page hosting from the main service; the vendor does publish its own availability at instat.us with maintenance announced 48 hours in advance.

Atlassian Statuspage

A documented REST API with an OpenAPI description covers incidents, components, metrics, status embeds and per-page role assignments for users, and SAML 2.0 single sign-on is documented for private pages and, with Atlassian Guard, for team members. We found no public information on audit logs, SCIM provisioning, two-factor authentication, monitoring-as-code or bulk import — the audit trail and provisioning controls I would need before rollout are not documented.

Instatus

A documented REST API covers status page updates, monitoring-tool integrations and on-call schedules, with signed webhooks, CSV subscriber import and export, and Zapier and Jira integrations; SAML single sign-on (Business plan, plus OpenID and CAS through the OrbitID identity platform, with many identity providers named), SCIM directory sync and multi-factor authentication are all stated. We found no public information on a Terraform provider or monitoring-as-code workflow, checks triggered from CI/CD, client sub-accounts or white-label reports. Most importantly for my ISO 27001 programme, we found no public information on audit logs — single sign-on without an audit trail still fails my access review.

Atlassian Statuspage

The record offered is a ninety-day per-component uptime history with a published formula that weights partial outages at thirty percent, rolled-up group averages and links to the related incidents, with incident postmortems reachable through the API and a service level agreement referenced in the customer agreement. Historical uptime can be edited by hand and degraded performance is excluded from the calculation, and we found no public information on response-time reporting, export of results, retention beyond the display window, or the vendor's own status page and incident history.

Instatus

The SLA publishes a 99% commitment for paid self-serve plans and 99.99% for Enterprise, a service-credit formula of ten times the hourly plan cost for each day with more than five minutes of downtime, a 30-day claim window, and availability measured from multiple locations with independent monitoring published on the vendor's own page. Per-monitor uptime and response statistics can be displayed publicly, per-component uptime history is supported, and data is exportable through the dashboard and API while the account is active. We found no public information on the retention period of check results, scheduled or client-facing reports, response-time percentiles, published probe IP addresses for allow-listing, or public post-mortems — so the record as documented would not yet stand on its own in one of my audits.

Atlassian Statuspage

The contracting entity is Atlassian Pty Ltd, incorporated in Australia with a San Francisco service address, and the privacy policy states information may be transferred and stored wherever Atlassian or its third-party providers operate; an EU representative and Irish law for EMEA customers exist. A data processing agreement is published with a publicly maintained subprocessor list and thirty-day change notice, but we found no public information on EU hosting options or where subprocessors are located, and audits and certifications are stated only in general terms.

Instatus

Instatus, Inc. is a Delaware corporation with Delaware governing law, and the privacy policy states data is stored primarily in the United States — including the on-call contacts and status page subscribers that are personal data under my NIS2 obligations. A data processing addendum applies automatically with the vendor as processor, EEA transfers rely on Standard Contractual Clauses, payments run through Paddle as merchant of record, and a subprocessors page is referenced though its contents were not captured. We found no public information on security certifications such as ISO 27001 or SOC 2, or on a self-hosted or open-source edition, so the chain cannot be closed on European terms from what is published.

Atlassian Statuspage

Five tiers from a free plan to Enterprise at $1,499 /month are public with subscriber, team-member, component and metric limits, and the agreement documents auto-renewal, overage at then-current rates and a thirty-day refund window. Team-member single sign-on requires the separately priced Atlassian Guard, additional team members beyond plan limits are handled by contacting support, and we found no public information on SMS message costs or VAT treatment.

Instatus

The pricing page lays out tiers with monitor counts of 15, 50 and 1,000, check intervals from 2 minutes to 30 seconds, subscriber, on-call member and team member limits, custom domains and alert channels per tier, a free starter tier, 25% off yearly with three months free on annual prepayment, and the terms state fees in US dollars excluding taxes with Paddle as merchant of record. However, the captured pages show no amounts for the Pro and Business tiers, and SMS and call alerts run through the customer's own Twilio, Vonage or similar account, so their cost is not stated by the vendor. An annual cost for a given team size is therefore not computable from what was captured.