Security

Encryption

All traffic to Atriam is served over TLS, with HTTP Strict Transport Security enabled. Connections between our application and our database are encrypted in transit.

Data at rest is encrypted at the storage layer by our database provider. Third-party access tokens — the credentials that let us connect to services on your behalf — get a second layer of AES-256-GCM encryption in our application before they are stored, so database access alone does not yield usable tokens. Those keys support rotation without downtime.

Tenant isolation

Every workspace's data is separated at the database level using PostgreSQL row-level security, not by application-layer filtering alone. A query that forgets a workspace filter returns nothing rather than someone else's records.

This is enforced in our build pipeline: automated checks reject any schema change that would create a table able to bypass tenant isolation, and the deploy fails rather than shipping it.

Payments

We never see or store your card details. All card entry happens on payment pages served entirely by Stripe, a PCI-DSS Level 1 certified provider. We retain only the card brand and last four digits that Stripe returns for display.

We keep it that way on purpose: three independent automated checks in our build pipeline block any code change that would start collecting card data on our own pages.

Access, logging, and recovery

Administrative access to production is limited to the smallest number of people who need it. Reads and exports of customer data on our most sensitive endpoints are written to an append-only audit log that cannot be edited or deleted through the application.

Database backups are taken on a schedule and stored encrypted, off our primary hosting platform, so a failure of that platform does not take the backups with it.

Policies and vendors

We maintain written information security, access control, encryption, change management, incident response, vendor management, and business continuity policies, along with a risk register we review on a set cycle and a register of every sub-processor that touches customer data.

What we don't claim

Security pages are easy to inflate. These are things we do not currently have, and we would rather say so than let you assume otherwise:

• We are not SOC 2 or ISO 27001 certified. We maintain the underlying control set and documentation; no external auditor has attested to it.
• We have not completed an independent third-party penetration test.
• We are not HIPAA compliant and do not sign Business Associate Agreements. Do not put protected health information into Atriam.
• We do not offer end-to-end encryption. Features like call recording, transcription, and AI assistance require our systems to process your content in readable form.

Reporting a vulnerability

Email help@atriam.ai with steps to reproduce. We aim to acknowledge reports within three business days.

Please give us a reasonable window to fix an issue before disclosing it publicly, and avoid accessing accounts or data that aren't yours while testing. We don't currently run a paid bug bounty, and we won't pursue legal action over good-faith research that follows these guidelines.