We hold credentials for your entire marketing stack. That sets the standard.

ATNOS is authorised to act inside your advertising, analytics and CRM accounts. Every control below is marked implemented or planned — we would rather be precise than impressive.

Encryption

Control	State	Detail
TLS 1.3 in transit	Implemented	Modern cipher suites with forward secrecy. HSTS with preload; TLS 1.0 and 1.1 disabled.
AES-256 at rest	Implemented	Databases, object storage and backups, with keys rotated on a fixed schedule.
Envelope-encrypted credentials	Implemented	Per-tenant data keys wrapped by a master key in a managed key service, stored separately from application data.
Customer-managed keys	Planned	Bring-your-own-key for organisations that require keys under their own control.

Authentication

Control	State	Detail
OAuth 2.0 with PKCE	Implemented	Authorization Code flow. ATNOS never requests, receives or stores passwords.
Refresh token rotation	Implemented	Rotates on every use with replay detection. A reused token invalidates the chain.
Multi-factor authentication	Implemented	Available on all accounts, enforceable workspace-wide. Hardware-backed for production access.
SAML and OIDC SSO	Planned	Federated sign-in with SCIM provisioning.

Access control

Control	State	Detail
Role-based access control	Implemented	Owner, admin, operator, analyst, billing — scoped per workspace.
Tenant isolation	Implemented	Row-level enforcement at the query layer.
Immutable audit logging	Implemented	Append-only, with actor, timestamp, source address and payload diff.
Least-privilege internal access	Implemented	Reviewed quarterly, revoked within four hours of a role change.
Audit log streaming	Planned	Continuous export to your own SIEM.

Infrastructure

Control	State	Detail
Private networking	Implemented	No publicly reachable databases. Infrastructure as code, peer reviewed.
Multi-zone deployment	Implemented	Application and data tiers across multiple availability zones.
Encrypted backups	Implemented	Point-in-time recovery over 35 days, replicated to a separate region.
Tested disaster recovery	Implemented	5-minute RPO, 4-hour RTO, validated twice yearly.
Regional data residency	Planned	EU, US or UK processing per workspace.

Monitoring and response

Control	State	Detail
Continuous vulnerability scanning	Implemented	Critical remediated within 7 days, high within 30.
Anomaly detection	Implemented	Authentication, agent behaviour and API usage monitored with automated alerting.
Incident response plan	Implemented	Documented severity, on-call rotation, escalation and communication.
Independent penetration testing	Planned	Annual third-party assessment, summary available under NDA.

Compliance

Framework	State
GDPR	Implemented
CCPA / CPRA	Implemented
Google API Services User Data Policy Including the Limited Use requirements — see Connected access	Implemented
SOC 2 Type II	Planned — not yet awarded
ISO/IEC 27001	Planned — not yet awarded

Best practices we recommend on your side

Enforce multi-factor authentication for every member of your workspace.
Grant the narrowest role that lets each person do their job, and review membership quarterly.
Set spend caps and approval gates that match your organisation’s risk tolerance, not ours.
Connect service accounts rather than personal accounts, so access survives someone leaving.
Review the audit log after any change to connected accounts or agent configuration.
Revoke connections you no longer use — an unused integration is still an open door.

Responsible disclosure

We commit to

Acknowledgement within 24 hours.
Assessment and remediation timeline within 5 business days.
Progress updates every 10 business days.
Public credit where wanted.

Out of scope

Testing against accounts you do not own.
Denial-of-service.
Social engineering.
Scanner output with no demonstrated impact.

Report to security@atnos.ai. Also published at /.well-known/security.txt per RFC 9116.