Trust Center
Atmos Pro
Atmos Pro is a hosted platform for managing Terraform and OpenTofu infrastructure with drift detection, deployment provenance, change governance, and audit logging. This portal contains our security and compliance documentation.
Purchasing Atmos Pro? Visit Procurement for vendor details, agreements, and payment options.
Controls
Internal security procedures
How Cloud Posse detects, responds to, and recovers from incidents, and governs risk.
PlannedIn progressPolicy establishedImplementedAudited
ControlStatus
Incident response process
Security reports reach security@cloudposse.com. The Incident Response Plan defines severity levels, roles, response-time targets, and notification within 72 hours of confirming a breach that affects a customer's data.
Incident Response PlanPublic security bulletins
Security-relevant incidents are communicated transparently via published security bulletins.
Logging and monitoring
Application telemetry and errors are monitored (Sentry, OpenTelemetry) for anomalies.
Logging, Monitoring and Retention StandardSecurity commitments communicated
Security commitments are communicated to customers in the SaaS Agreement and Terms of Use.
Service description communicated
A description of the product and services is provided to internal and external users.
Business continuity and disaster recovery established
The production database (Neon-managed PostgreSQL) has continuous point-in-time recovery and deletion protection enabled, with backups encrypted at rest in AWS us-east-1 (US). A formal BC/DR plan is approved and published.
Business Continuity and Disaster Recovery PlanBusiness continuity and DR tested
Monthly automated database restore verification and an annual full-service DR exercise are being established; completed test evidence is required before this control is implemented.
Business Continuity and Disaster Recovery PlanRisk assessment performed
A risk management policy and a risk register are published. The first formal annual risk assessment is pending.
Risk Management PolicyRisk RegisterVendor management program
An inventory of critical subprocessors, with security and privacy requirements and an annual review, is being set up.
Vendor Management PolicyVendor agreements include confidentiality
Cloud Posse is confirming that its agreements with vendors and third parties include confidentiality and privacy commitments.
Vendor Management PolicyManagement oversight of security
The Information Security and Risk Management policies define regular leadership reviews of cybersecurity and privacy risk. The first review is being set up.
Information Security PolicyRisk Management PolicySecurity Roles and ResponsibilitiesWhistleblower policy established
A whistleblower policy and a channel to report concerns or fraud are being formalized.
Cybersecurity insurance maintained
Cloud Posse holds a cyber insurance policy. The policy covers Atmos Pro.
SOC 2 system description
A system description for the SOC 2 report is in preparation.