Atlas ReportingOS holds the revenue data of the businesses that use it: their ads, leads, calls and payments. This page sets out how we protect it. It describes the controls in place today, and it is reviewed every six months.
1. Encryption
1.1 In transit
Every connection to Atlas is encrypted with TLS 1.2 or higher, all the way to our servers, and HTTPS is enforced.
- There is no unencrypted hop between your browser and our servers.
- Our servers accept web traffic only through our firewall, so it cannot be bypassed.
- Databases and internal services are never exposed to the internet.
- Calls to the platforms you connect are made over HTTPS.
1.2 At rest
- Backups: encrypted before they leave the server, with the keys held apart from the systems they protect.
- Connected-account credentials: the OAuth tokens and API keys for the tools you connect are encrypted inside the database with a separate application key, so a copy of the database alone cannot reveal them.
- Passwords: hashed with a salted, one-way algorithm built for passwords, never stored as readable text.
- Atlas API keys: stored as hashes. The full key is shown once, when it is created.
1.3 Access
Every administrative account is protected by two-factor authentication.
2. Vulnerability management
Every change to the Atlas code is scanned automatically for known vulnerabilities, the live app is scanned from the outside, and the scans repeat on a regular schedule. Findings are flagged to us when a scan runs, and critical, high and medium findings each carry a fix deadline set by their severity. The production servers install operating-system security updates automatically.
3. Security testing
Our most recent test, in October 2026, attacked the live app and API from the outside across the OWASP Top 10, first without an account and then signed in to a real one, including attempts to reach another customer’s data and connected-platform credentials. It found no confirmed vulnerabilities.
Sign-in is protected against password guessing, and sessions are hardened against hijacking and expire automatically.
4. Monitoring and incidents
Production is monitored continuously for errors, downtime and failed scheduled jobs, including backups, and every alert goes straight to the people who fix it.
We follow a written incident response plan with named owners, set severity levels and fixed steps from first confirmation through containment, recovery and review. Every serious incident ends with a written review and a change to stop it happening again.
If your data is affected: we notify you by email without undue delay, and within 72 hours of becoming aware of a breach that affects your personal information, as our Privacy Policy commits. We tell you what happened, what data was involved, what we have done and what you should do. Where we hold data on your behalf, our notice gives you what you need to meet your own obligations. Where the law requires us to notify a regulator ourselves, we do.
5. Backups and recovery
The database is backed up every day, encrypted, and stored apart from production in storage that locks recent backups against deletion, so even a compromised server cannot erase them.
6. Where your data is stored
All customer data, live and backed up, is stored in the United States. International transfers are covered in section 9 of our Privacy Policy.
7. Subprocessors
These companies process customer data on our behalf to help us run Atlas.
| Company | What it does | Data it touches | Based in |
|---|---|---|---|
| Hostinger International Ltd. | Hosts the production servers, in the United States | All production data, at rest | Cyprus |
| Cloudflare, Inc. | Network security, content delivery and backup storage in the United States | Traffic in transit and the encrypted backups | United States |
| Stripe, Inc. | Processes subscription payments | Billing details. Card numbers stay with Stripe | United States |
| Plus Five Five, Inc. (Resend) | Sends the app’s emails | Recipient addresses and email content | United States |
| Functional Software, Inc. (Sentry) | Error monitoring, in the United States | Technical error details | United States |
| Google LLC (Google Workspace) | Support mailboxes | Emails sent to or from them | United States |
We email customers at least 30 days before we add or replace a subprocessor that handles customer data, and they can object, as our Data Processing Addendum sets out. This list was last updated on November 2, 2026.
The platforms you connect yourself, such as Meta, Google, Stripe, Close and Typeform, are your own accounts, authorized by you with OAuth or your own API key. They are not our subprocessors. Our Privacy Policy explains how that data is handled.
8. Reporting a security issue
If you believe you have found a vulnerability in Atlas, email security@reportingos.com. Please include enough detail for us to reproduce the issue, and give us a reasonable chance to fix it before sharing it publicly.
We will not pursue legal action over research done in good faith within these limits: test only against your own account, do not access, change or delete anyone else’s data, do not degrade the service for others, and stop and tell us as soon as you find a problem.
9. Security reviews
For a vendor review or security questionnaire, email security@reportingos.com. We share detailed security documentation under NDA.
Our Data Processing Addendum is part of our Terms of Service, so it covers every customer without a separate signature. If you need a signed copy, email the same address.
This page describes our security program as of the review date above. It is provided for information, it does not form part of our Terms of Service, and it changes as our controls change.