AtlasOA is designed around five categories of defense, in order of impact:

• Data residency. Your assessment data lives on hardware your campus owns. Nothing is stored in a vendor cloud, no telemetry phones home, no third party can subpoena what we do not have.
• Access control. Role-based authorization plus per-record visibility checks. A faculty user cannot read records outside their permission scope, even by guessing IDs.
• Network isolation. The main application process has restricted outbound network access. External lookups are scoped to a sandboxed allowlist.
• Audit logging. Every state-changing action is recorded to a separate, append-only audit database with hash-chain integrity verification.
• Code-level defense. Parameterized queries, CSRF protection on every state-changing endpoint, validated file uploads, salted password hashing.

Every release goes through three layers of review before it ships:

• Automated test suite. Hundreds of tests run on every commit, covering authentication, authorization, data integrity, audit logging, file handling, and the core assessment workflow. Releases are blocked if anything fails.
• Internal security audit. Before each release, the codebase is reviewed against the OWASP Top 10 and a custom checklist focused on assessment data: SQL injection, cross-site scripting, broken access control, insecure file handling, sensitive-data exposure, and authentication weaknesses.
• Adversarial code review. Each release is also reviewed by an in-house red-team pass that actively tries to break the controls: race conditions, IDOR enumeration, prompt injection on the AI assistant, path traversal, and bypass of the network isolation layer.

Findings are tracked in a private security log and remediated before the release reaches founder partners. We treat every audit cycle as another chance to harden the platform.

We would rather build the controls than wave a sticker. Here is the honest list of what we have not done:

• No third-party penetration test yet. Internal adversarial review is rigorous, but it is not the same thing as a paid pen-test from an outside firm. We are planning one before our first non-founder customer ships to production.
• No SOC 2 Type 2 yet. SOC 2 is a process audit, not a security audit, and we are not large enough to justify the $40K to $80K annual cost yet. When founder revenue supports it, we will pursue it.
• No HIPAA or FERPA certification. AtlasOA is FERPA-aware (audit logging, access controls, data residency on your servers), but FERPA compliance is determined by how the institution operates the platform, not by a vendor cert. We will help your registrar map AtlasOA to your FERPA program.
• No "military-grade" anything. The phrase is marketing fluff. We use industry-standard controls.

Any vendor that tells you they have all of the above - regardless of company size - should be asked to produce the actual letter of attestation. Marketing pages are not evidence.