How Atlas handles
your data.

Every table in Atlas carries a tenant_id, and every query filters by it — one tenant's brands, contacts, and generated assets are never visible to another. Atlas can run as a shared multi-tenant service or as a fully self-hosted, single-tenant instance on your own infrastructure; in the self-hosted case your data never leaves a system you control.

The database is a single SQLite file plus your generated media assets. You can request a full export or a full deletion of your tenant's data at any time — because of the isolation model, deletion is a clean, verifiable operation rather than a best-effort scrub.

No module in Atlas talks to an AI provider directly. Every AI call — text, image, voice, or video — passes through a single internal AI Orchestration Gateway, which is the only component with provider credentials. This exists so we can swap, add, or retire model providers without touching product code, and so every AI call is logged in one place with its cost and latency.

Depending on the task, a request may be routed to Google (Gemini models), Anthropic (Claude models), self-hosted open-weight models we run ourselves (via Ollama), or ComfyUI for image/video generation — which can run in our cloud or entirely on hardware you control. Which provider handles a given request is a routing decision, not a fixed integration, and it changes as we evaluate models. Content sent to a third-party provider is governed by that provider's own API terms; commercial API traffic is typically excluded from a provider's consumer-product training data, but we encourage you to review each provider's current policy rather than take our word for it.

We do not use your content to train our own models.

Accounts are authenticated with JWTs and passwords are hashed with bcrypt — Atlas never stores a plaintext password. Third-party integration credentials (LinkedIn, Meta, Google, Microsoft, SMTP, and others) are encrypted at rest in a dedicated credentials vault, not left in plain environment files.

Every mutating action — creating a brand, publishing a post, changing a setting — writes an audit-log entry in the same transaction as the change. If there's no audit entry, the mutation didn't happen. This is a hard requirement for every new feature we ship, not an afterthought bolted on later.

Billing runs through Stripe. Atlas never sees or stores your raw card number — Stripe handles card entry, tokenization, and PCI compliance directly; we only store the resulting subscription and customer identifiers needed to manage your plan.

Atlas is early-stage software built with compliance-heavy customers in mind — audit coverage, tenant isolation, and a self-hosted option all exist because of that. What we won't do is claim a certification we don't hold: Atlas does not currently carry SOC 2, ISO 27001, or a similar third-party attestation. If your organization requires one before onboarding, tell us — we'd rather have that conversation up front than let the page oversell it.

If you find a vulnerability or something on this page looks wrong, we want to hear about it directly rather than through a public issue. Email nasir@thesolutionerslabs.ca with what you found and how to reproduce it, and we'll follow up.