The argument I'd make isn't about UI or features, it's about who owns security afterwards. The vendor has people whose whole job is patching things like this Ruby regex issue. The internal vibe-coded Jira usually has nobody, and the bugs that bite are boring ones, like a project page that loads for anyone who guesses the ID.

If they go ahead anyway, the ask is just that someone actually owns it after launch, not only builds it.

This person is just posting absolutely baseless claims, as if Atlassian, a company that basically exists purely on the back of B2B SaaS sales, has not considered EU data residency requirements in their core product offering: https://www.atlassian.com/software/data-residency

In short gdpr compliant means you can configure it but it must not be compliant by default and also there is no guarantee.

They are constantly changing their software and settings. More than once they believed that something is legal but can be risky for the atlassian customer.

For example training AI on metadata which they believe are anonymized but are maybe not enough changed.

Training data or metadata permisson can not be configured on all subscriptions. But as a data processor they must follow the contract otherwise they become data controller.

Also there are risks associated with privacy data framework, cloud act etc. to be non compliant just by data transfers to other countries.