Trust Center
Atmos Pro
Atmos Pro is a hosted platform for managing Terraform and OpenTofu infrastructure with drift detection, deployment provenance, change governance, and audit logging. This portal contains our security and compliance documentation.
Purchasing Atmos Pro? Visit Procurement for vendor details, agreements, and payment options.
Controls
Product security
How changes to Atmos Pro are reviewed, scanned, and shipped safely.
PlannedIn progressPolicy establishedImplementedAudited
ControlStatus
Peer code review, with a reviewed owner exception
All changes are made via pull request and reviewed automatically by CodeRabbit, with at least one human approval enforced as a required status check on the main branch. The Owner may merge their own change without the human approval; the CodeRabbit review, security scans and all other required checks still apply, and someone other than the Owner reviews those merges quarterly.
Automated security scanning with merge-blocking gate
Semgrep (SAST — static application security testing), Trivy (SCA — dependency and misconfiguration scanning), and Gitleaks (secret scanning) run on every pull request, every push to main, and weekly. Chainguard Malcontent (supply-chain and malware scanning) runs on every pull request and push. Critical/High findings or any detected secret are a required, merge-blocking status check on the main branch.
Vulnerability and Patch Management PolicyComprehensive audit logging
Most security-relevant actions are recorded to an audit log available to customers, with retention set by plan tier and documented defaults. Entries are appended by application convention; database-level immutability and cryptographic tamper-evidence are on our roadmap.
Logging, Monitoring and Retention StandardChange management procedures enforced
Changes are authorized, documented, tested, reviewed, and approved before deployment to production.
Secure Development and Change Management PolicyProduction deployment access restricted
The ability to migrate changes to production is restricted to authorized personnel.
Development lifecycle established
A defined SDLC governs development, change, and maintenance of the service.
Secure Development and Change Management PolicyConfiguration management
System configurations are managed as code and deployed consistently across environments.
System Hardening and Configuration StandardResponsible disclosure program
A published responsible-disclosure policy provides a clear channel for reporting vulnerabilities.
Control self-assessments conducted
Periodic internal control self-assessments are planned as the SOC 2 program matures.
Independent penetration testing
Annual independent penetration testing is required by the vulnerability policy; the first test is being scheduled.
Vulnerability and Patch Management Policy