Security
Security at Atlas.
How we think about it, how we run the platform, and what we have not done yet.
Our statement
Our own security comes first.
Atlas licenses and protects other people’s software, and our servers hold their customers’ sign-ins, hardware identifiers and IP addresses. If our platform is weak, everything built on it is weak. We treat our own security as part of the job, not an add-on.
No software is fully secure, ours included. Protection that runs on a customer’s machine can be attacked by a determined analyst. That is why enforcement that matters lives on our servers: sessions, variables and files go only to a verified session, so a cracked client still has nothing to read.
We fix issues fast, we say where we fall short, and a claim we cannot stand behind is not on this site.
Operations
How we operate.
- Our own servers. The database and the authentication servers run on hardware we operate in Saudi Arabia, with Cloudflare in front of the website and API.
- One team. The people who write the code run the servers and read security reports, so a report reaches someone who can fix it.
- Changes. Every release to the live site is backed up first, so a bad one is rolled back instead of patched live.
- Reviews on paper. Our reviews of the authentication server and the backend record what was fixed, what was only partly fixed and what we chose to skip, and why.
- Claims checked. Each protection claim on this site is traced to the source that does it. Claims that did not hold up were removed.
- Watching. Six services are probed every 15 seconds and an outage alerts a phone. The live state is on the status page.
- Access. Staff see only what their role allows, destructive actions need a PIN, and staff actions are logged. Every query is scoped to the customer’s application.
- Accounts. Dashboard passwords are hashed with bcrypt, a sign-in from a new device needs emailed approval, and passkeys are supported.
- Releases. Each release of the Atlas library is signed.
- Data. What we collect and how long we keep it is in the Privacy Policy. We do not sell it.
Privacy Policy and Subprocessors cover the data side in full.
The limits
What we have not done yet.
- No independent penetration test or certification, such as SOC 2 or ISO 27001.
- No authenticator-app second factor for password sign-in.
- Data on our servers is not separately encrypted at rest.
- Database backups are taken by hand.
- Atlas runs from one location with no failover. The status page shows when it is down.
- A lawyer has not reviewed our legal documents.
Responsible disclosure
Found something? Tell us first. We welcome security research done in good faith and within an authorized scope. Report privately, give us reasonable time to fix, and avoid privacy violations, service disruption and data destruction.
The rules for authorized testing are in the Acceptable Use Policy.
[email protected]- Acknowledgement
- within 24 hours
- Initial assessment
- within 5 business days
- Critical fix target
- 7 days
- High fix target
- 14 days
- Coordinated disclosure
- after a patch ships
We'd rather be trusted than impressive.
Straight answers, fast fixes and a list of what we have not done yet.
- Free to start, no card
- SDK for C++, JavaScript and Python
- Windows x64