Security Overview

Last updated: July 8, 2026

Hosting & infrastructure

Atrium Elite runs on Amazon Web Services (US). Compute runs on managed containers (ECS Fargate); data is stored in managed PostgreSQL (RDS) and object storage (S3). Infrastructure is defined as code and deployed through an automated CI/CD pipeline.

Data protection

• In transit: TLS for all connections.
• At rest: database and object storage encrypted at rest.
• Tenant isolation: every record is scoped to an owning account; queries enforce that scope.
• Documents: served only through scoped application routes, never public bucket URLs.

Authentication & access

• Managed identity provider (Amazon Cognito); passwords are not stored in readable form.
• Multi-factor authentication (TOTP) supported/enforced.
• Role-based access control within each account (admin/manager/viewer) and least-privilege internal access.

Operations

• Automated dependency and container vulnerability scanning, secret scanning, and a hard CI gate on high-severity findings.
• Centralized logging and monitoring; audit logging of sensitive admin actions.
• Regular patching; immutable, checksummed database migrations.
• Automated backups of the primary database. (Recovery-time and recovery-point objectives are being formalized.)

Development

Changes go through code review, automated tests, type-checking, and security scans before deploy. Least-privilege deploy credentials via OIDC (no long-lived cloud keys in CI).

Reporting a vulnerability

Email security@atriumelite.com. We welcome responsible disclosure and will acknowledge reports.

In progress

We continually strengthen our security program. Some controls — such as a SOC 2 examination, third-party penetration testing, and a web application firewall — are planned but not yet in place. We describe only controls that are actually implemented, and we update this page as our program matures.