Security
How ATLAS protects your business data.
No compliance badges, no bluff. Below are the security practices actually implemented in the product — the same ones our internal security review program holds us to.
Implemented practices
What's in the product today
Each practice below is implemented in the running product — verified against the codebase, not the roadmap.
Tenant isolation by design
Every organization's data is scoped to that organization on every request. The organization context comes from the session — never from a URL parameter or a cookie value — and access checks run on every API route.
Role-based access, per location
Four standard roles (owner, admin, manager, member) plus custom roles, with permissions scoped to each user's assigned locations. “Strictly-below” rules mean people can only edit beneath their own level.
Audit logging
Administrative actions are recorded with the actor, the action, and the time. When something changes in your organization, there's a record of who did it.
Encryption of sensitive fields
Sensitive stored data — HR fields and stored integration credentials — is encrypted at rest. Uploaded files pass content validation: the stored type is detected from the file itself, never trusted from the browser's claim.
Strict session controls
Sessions expire after 10 minutes of inactivity. Signing in on a new device signs out all other devices, with a “signed in on another device” message. TOTP multi-factor is available, passwords are hashed with bcrypt, and repeated sign-in failures lock the account.
Bot and brute-force protection
Sign-in is guarded by Cloudflare Turnstile bot checks, IP-based rate limiting, and a per-account lockout that survives IP rotation. Abuse budgets are enforced in-memory per endpoint.
Said plainly
What we don't claim
Security marketing is full of badges. Here's where we stand.
No certifications — yet
ATLAS holds no SOC 2, ISO 27001, or other compliance certifications. We're a new product working through an internal security review program. We publish practices, not certificates — and we won't invent a badge to look bigger than we are.
Security is a program, not a page
The practices above are reviewed in cycles: static analysis of every API route, dependency audits, and regression tests for tenant isolation. Every review cycle ends with fixes before launch — the program exists to catch issues, not to certify perfection. If you're evaluating ATLAS for your business, ask us and we'll answer with specifics, not slogans.
Your data, guarded by design.
$250/month plus $5 per active user. Monthly terms, cancel anytime.
Published pricing · Monthly terms · Cancel anytime