Trust Center
Atmos Pro
Atmos Pro is a hosted platform for managing Terraform and OpenTofu infrastructure with drift detection, deployment provenance, change governance, and audit logging. This portal contains our security and compliance documentation.
Purchasing Atmos Pro? Visit Procurement for vendor details, agreements, and payment options.
Controls
Organizational security
How the Cloud Posse team is vetted, trained, and granted access internally.
PlannedIn progressPolicy establishedImplementedAudited
ControlStatus
Multi-factor authentication enforced
MFA is required for access to source control, cloud, and production systems.
Password and Authentication StandardLeast-privilege internal access
Employee access to production data is limited to those with a business need.
Personnel confidentiality agreements
All personnel, including employees and contractors, sign a confidentiality (NDA) agreement.
Personnel Security PolicyOnboarding and offboarding procedures
Access is granted on onboarding and removed on offboarding by hand. A documented checklist, with a record of each change, is being set up.
Access Control PolicyInformation Security PolicyPersonnel Security PolicyPeriodic access reviews
Quarterly access reviews covering production systems, Google Workspace, and GitHub are being established; the first formal review remains pending.
Access Control PolicyBackground checks
The Personnel Security Policy requires a background check, where the law permits, before a person gets production access. Checks for current personnel are not yet complete.
Personnel Security PolicySecurity awareness training
A recurring security awareness training program for all team members is being rolled out.
Security Awareness Training PolicySecurity policies established
Information security, acceptable use, and related policies are approved and published. They are reviewed at least annually.
Information Security PolicyAcceptable Use PolicySecurity Roles and ResponsibilitiesCode of conduct established
A code of conduct that sets expectations for behavior and ethics is being written.
Asset inventory and disposal
The Physical Security Policy covers the inventory of company devices and their secure disposal at end of life. The device inventory is being set up.
Physical Security PolicyEndpoint protection
The System Hardening and Configuration Standard requires malware protection on devices used for company work. Automated checks of each device are being rolled out.
System Hardening and Configuration Standard