Atmos Pro

Cloud Posse's cyber insurance policy covers Atmos Pro.

The SaaS Agreement is now listed under Legal in the Trust Center. It shows the same text as atmos-pro.com/legal/saas-agreement. Every public legal document can now be saved as a PDF or Word file, with its title, Last Updated date, and Cloud Posse, LLC.

Controls now show In progress when work has started but no approved policy or evidence exists yet. Controls backed by our newly published security policies now show Policy established.

Each control now shows how far it has progressed: Planned, Policy established, Implemented, or Audited. We mark a control Implemented only when evidence shows it operates.

Our security policies and standards are now in effect and available in the Trust Center. They cover information security, access control, encryption, incident response, business continuity, vendor management, secure development, and more.

A written Incident Response Plan now defines severity levels, roles, response-time targets, and notification within 72 hours of confirming a breach that affects a customer's data. The Security Overview and Security Architecture whitepaper now describe that plan instead of an ad hoc process.

You can now download Trust Center documents as Word files, in addition to PDF.

Specified that the production database (Neon-managed PostgreSQL) has continuous point-in-time recovery and deletion protection enabled, with backups encrypted at rest in AWS us-east-1 (US) and containing only operational metadata — never customer source code or infrastructure state.

Our incident response control and whitepaper previously read as a fully documented process. Detection (Sentry, Vercel WAF, audit logs), an intake channel (security@cloudposse.com), and public incident communication are real and live today, but a written runbook defining severity levels, roles, and response timelines doesn't exist yet — that's in development.

Semgrep (SAST), Trivy (SCA), Gitleaks, and Chainguard Malcontent Critical/High findings, or any detected secret, now block merges to main via required status checks.

Our offboarding checklist exists but had gone stale from infrequent use, so we described it as out of date and being refreshed rather than as a fully current, actively maintained process. Also scoped the data-retention control description to what's actually automated today.

Published new controls and FAQ entries covering the read-only customer-gated support access model, personnel confidentiality agreements, and DPA availability.

Added an interactive trust-boundary diagram and a numbered data-flow table to Resources, mapping how data moves between your browser, Atmos Pro, GitHub, and your own cloud.

Added a Data Classification Matrix to Resources. It lists each type of data Atmos Pro handles, how sensitive it is, and how we protect it.

Simplified the access-request workflow for gated Trust Center documents.

Published the Atmos Pro Trust Center with security and compliance documentation, control checklists across five areas (infrastructure, organizational, product, internal procedures, and data & privacy), a procurement FAQ, and a document request-access workflow.

Published the Atmos Pro Security Architecture Whitepaper covering trust boundaries, the GitHub-only integration model, webhook security, encryption, audit logging, and data retention.

Added support for GitHub Enterprise Managed Users (EMU) organizations, so customers on GitHub EMU can install and use Atmos Pro.