Loading. Please wait...
Security
Atlas holds the keys to other people’s Microsoft tenants, accounting systems and password vaults. This page is specific about how that is protected, and it starts with the bad news.
No SOC 2, no ISO 27001, no IRAP, no FedRAMP. If your procurement process requires one, Atlas will not pass it today, and we would rather you learn that here than three calls in. What follows is the actual engineering posture, which is the only thing we can honestly offer in place of an auditor’s signature.
Atlas is multi-tenant, so this is the control that matters most. It is enforced in the database rather than in application code, because application code has bugs.
Postgres row-level security restricts each row to the organisations the signed-in user is a member of. A query that forgets its tenant filter returns nothing rather than returning everything.
The Supabase Data API is a parallel write path that bypasses application permission checks, so sensitive tables grant SELECT only to members and every insert, update and delete runs server-side after the permission gate. Tables that hold credentials grant nothing to members at all.
Where a table is readable but some of its columns are not - HR notes and contract files, encrypted credentials, cached profile photos - the grant is revoked at column level, so the field is unreachable over the API even by a member who can read the row.
Access is by permission key rather than by job title, resolved per organisation. A technician can be given the service desk without the commercial modules, or reporting without the password vault.
Atlas holds keys to other people’s systems: Microsoft tenants, accounting, distributors, domains. That is the most valuable thing in the database and it is treated that way.
Password vault entries and integration secrets are AES-encrypted, and the ciphertext columns are revoked from the data API entirely rather than merely policy-protected.
Reading a stored password writes an audit record naming who read it and when. There is no way to read one that does not.
Public links - a quote to accept, a delivery receipt to sign, an erasure certificate to verify, a signature to approve - are signed tokens scoped to one record and one action, single-use where a decision is involved, and they never confer a session.
Each client tenant consents the Atlas application itself. Adding a permission means re-consenting, which is visible to the customer rather than silent.
The question a privacy officer asks, and the answer is better than most platforms can give.
Server-side signature stamping happens inside Exchange Online through a transport rule; the endpoint agent writes a file to the device; the Outlook add-in inserts markup in the client. In none of the three does a message pass through our infrastructure.
Microsoft 365 backup reads from Graph and writes to object storage. Atlas orchestrates it and holds the index, not a second copy of the mail.
Campaign banner clicks are counted because somebody chose to click. Impressions are not, because counting them would mean a pixel in every message your clients’ staff send - a read receipt on their entire correspondence.
The endpoint agent can run code on other people’s computers, which is the sharpest thing in the product.
Automated remediation is never fire-and-forget: each action is approved before it runs, and nothing force-reboots a machine.
The Windows installer and both resident scripts are EV-signed; the macOS daemon is notarized. They are served from our own domain, not a file host.
Writes that place real orders or change a customer tenant start disabled. NBN ordering ships in testing mode; Exchange transport rules are created disabled and in audit mode, and going live is a separate confirmed action.
Privileged actions, configuration changes and data access are written to an append-only audit log, with a weekly digest. It currently holds 24,900 events.
Send security issues to the address below, or book a call and say in the notes that it is a security report. Either way it is routed straight through rather than into a sales queue. We will confirm receipt, and we will tell you what we found and what we changed.