Security
Built so brands stay apart.
Isolation, access, secrets, an audit trail and backups, in plain words.
Controls
What protects your content
The controls that run on every brand, all the time.
Brand isolation
Every record belongs to one brand and every request is checked against it. A record of another brand answers "not found".
Roles per brand
Editors write drafts, publishers decide what goes live, admins manage settings. Every brand keeps at least one admin.
Encrypted secrets
Integration keys and passwords are stored encrypted and are never shown again, not in the dashboard, the API or a log.
Signed webhooks
Every message carries an HMAC-SHA256 signature and a timestamp, so your site can refuse a fake or a replay.
Audit trail
Changes to live content are recorded with who and when, using ids and never content or secrets. Revisions let you roll back.
Backups
Database backups are encrypted, kept for at most one month on a rolling basis, and leave out personal data by default. Longer retention is a paid add-on on request.
Verified restores
Backups are checked by restoring them in a scratch database, and a failed run shows up in our console.
Safe content
Links are checked on save and when served, rich text and SVG uploads are cleaned, and uploads are verified.
Data
How we handle data
Where it lives, who touches it and how to reach us.
Where your data lives
ATLAS runs on servers operated by us in Indonesia. Providers that help us run the service work under confidentiality and data protection duties.
Read the Privacy PolicySign in and sessions
Passwords are stored as hashes. You can sign in with Google or GitHub on an account that already exists. Changing your password signs out your other devices.
AI stays a draft
AI drafting uses third-party models through processors bound by contract. Its output is a draft until a person publishes it.
Report a problem
Found a vulnerability? Tell us first. We review every report and tell you when it is fixed.
[email protected]
Data protection and security contact
Questions about your data, a request under UU PDP or a security report: [email protected].