Hosted in the EU
The database and stored files are in EU data centers. AI features are off until a company turns them on and accepts the AI addendum; when they are on, the AI provider may process the request outside the EU.
Security
How Atitic protects your records
The controls built into the product, where your data is kept, and how to reach us about a vulnerability. The binding commitments are in the terms of service and the privacy policy.
Each company kept apart
Row-level security in the database separates companies on every table that holds their data, so the application itself cannot read across them. The few tasks that work across companies use a separate role, only in places listed in the code and checked at every build.
Strong sign-in
Passwords of at least 12 characters, stored as Argon2id hashes, with repeated attempts slowed down. Two-factor sign-in, which a company can require for everyone. Single sign-on with Microsoft Entra ID, Google or SAML, and user provisioning with SCIM.
Access by role
Roles per module, with separate rights to read, manage and approve. External auditors see only the audit they are invited to, always with two-factor sign-in, and their access ends 30 days after the audit closes.
Tamper-evident records
Every change goes into an audit log in which each entry is chained to the one before. The chain is checked every night and its latest position is copied outside the database, so removed or rewritten history shows. Evidence files carry a SHA-256 fingerprint.
Protection in the application
Encrypted connections only, a strict content security policy, a token on every form against cross-site requests, and uploads limited to allowed file types. Credentials for integrations and cloud connections are stored encrypted, with the key kept outside the database.
Your data if you leave
A portability report exports your records as PDF and spreadsheet, so you can rebuild your compliance work elsewhere.
Commitments in writing
Encryption at rest, backups, recovery targets, independent penetration testing and how fast vulnerabilities are fixed are set out in the terms of service. The subprocessors and where they process data are in the privacy policy.
Report a vulnerability
Found a security problem in Atitic? Write to us privately at [email protected] with what you found and how to reproduce it.
Please test only against your own account, do not access other people's data, and give us time to fix the problem before you disclose it.