Atmos ProAtmos Pro
Trust Center
Contact security

Atmos Pro

Atmos Pro is a hosted platform for managing Terraform and OpenTofu infrastructure with drift detection, deployment provenance, change governance, and audit logging. This portal contains our security and compliance documentation.

security@cloudposse.comPrivacy Policy

Purchasing Atmos Pro? Visit Procurement for vendor details, agreements, and payment options.

OverviewResourcesControlsSubprocessorsFAQUpdates

Controls

Infrastructure securityOrganizational securityProduct securityInternal security proceduresData and privacy

Infrastructure security

How Atmos Pro secures its GitHub integration, isolates execution, and protects data in transit and at rest.

PlannedIn progressPolicy establishedImplementedAudited
ControlStatus
No standing access to customer infrastructure clouds
Atmos Pro holds no credentials for your infrastructure cloud accounts (AWS, Azure, GCP). It integrates only with GitHub, through a GitHub App that uses short-lived installation tokens.
Optional cross-repo GitHub token broker (STS)
Optionally, Atmos Pro can mint short-lived, read-only GitHub App tokens per CI run so your pipelines can pull private Terraform modules and components from other repos where Atmos Pro is installed. This is GitHub-only — it never mints or touches cloud (AWS/Azure/GCP) credentials, which are obtained entirely by your own CI runners via OIDC, outside Atmos Pro's control.
Least-privilege GitHub App scopes
Repository access is granted through a GitHub App with narrowly scoped, reviewable permissions — not a personal access token.
Encryption in transit
All traffic to and from Atmos Pro is encrypted with TLS 1.2+.
Encryption Standard
Encryption at rest
Application data is stored on managed infrastructure (Vercel, Neon Postgres) with encryption at rest enabled by default.
Encryption Standard
Unique production authentication enforced
Access to production systems requires unique, individually attributable credentials — no shared accounts.
Password and Authentication Standard
Remote access MFA enforced
Multi-factor authentication is required to access production systems and source control.
Password and Authentication Standard
Encryption key access restricted
Access to encryption keys and secrets is restricted to authorized users with a business need.
Encryption Standard
Production access restricted
System and database access in production is restricted to authorized personnel.
Access Control Policy
Access revoked upon termination
Access to production systems is removed by hand when a team member leaves. A written offboarding checklist, with a record of each removal, is being set up.
Personnel Security Policy
Managed, hardened hosting
Production runs on managed platforms (Vercel, Neon), inheriting their physical, network, and firewall controls rather than self-managed servers.
System Hardening and Configuration StandardPhysical Security Policy
Web application firewall (WAF)
A managed web application firewall sits in front of Atmos Pro, with bot mitigation, rate limiting, and configurable rules. Edge traffic is continuously monitored.
Webhook signature verification
Inbound GitHub webhooks are verified against a shared secret before processing.
Egress IP allow-listing
Outbound traffic for customer-initiated runs originates from a documented, stable set of egress IPs that can be allow-listed.
Infrastructure monitoring and alerting
Production health and errors are continuously monitored with alerting (Sentry, OpenTelemetry).
Logging, Monitoring and Retention Standard