Trust Center
Atmos Pro
Atmos Pro is a hosted platform for managing Terraform and OpenTofu infrastructure with drift detection, deployment provenance, change governance, and audit logging. This portal contains our security and compliance documentation.
Purchasing Atmos Pro? Visit Procurement for vendor details, agreements, and payment options.
Controls
Product security
How changes to Atmos Pro are reviewed, scanned, and shipped safely.
ControlStatus
Mandatory peer code review
All changes are made via pull request and require two layers of review before merge: automated review by CodeRabbit and at least one human approval, both enforced as required status checks on the main branch.
Automated security scanning with merge-blocking gate
Semgrep (SAST — static application security testing), Trivy (SCA — dependency and misconfiguration scanning), and Gitleaks (secret scanning) run on every pull request, every push to main, and weekly. Chainguard Malcontent (supply-chain and malware scanning) runs on every pull request and push. Critical/High findings or any detected secret are a required, merge-blocking status check on the main branch.
Comprehensive audit logging
Most security-relevant actions are recorded to an audit log available to customers, with retention set by plan tier and documented defaults. Entries are appended by application convention; database-level immutability and cryptographic tamper-evidence are on our roadmap.
Change management procedures enforced
Changes are authorized, documented, tested, reviewed, and approved before deployment to production.
Production deployment access restricted
The ability to migrate changes to production is restricted to authorized personnel.
Development lifecycle established
A defined SDLC governs development, change, and maintenance of the service.
Configuration management
System configurations are managed as code and deployed consistently across environments.
Responsible disclosure program
A published responsible-disclosure policy provides a clear channel for reporting vulnerabilities.
Control self-assessments conducted
Internal control self-assessments are performed periodically as the SOC 2 program matures.
Independent penetration testing
Third-party penetration testing is being scheduled as part of the SOC 2 program.