01 · In transit
Encrypted on the wire
All traffic to Atomburst is encrypted in transit with TLS, and atomburst.io enforces HTTPS with HSTS (preload). Plain-HTTP access is never served.
Security & Compliance
We hold the data that catches the threat.
A detection and response platform only works if you trust it with sensitive signal. Here's exactly how Atomburst handles, protects, and retains your data — and where we are on formal compliance, stated plainly.
Data handling
How your data is protected.
How the platform and console handle customer signal today.
02 · At rest
Encrypted in storage
Console data lives in a managed Postgres encrypted at rest by our hosting provider. Session cookies are additionally encrypted at the application layer — not merely signed.
03 · Tenancy
Default-deny, isolated per tenant
Authorization is default-deny: an identity reaches a tenant only if it matches that tenant's explicit access rules, and every query is scoped to the tenant. Nobody gets in because they merely have an account.
04 · Access control
No passwords, least privilege
Sign-in is GitHub-based — we never store passwords. Auth endpoints are rate-limited, admin actions are logged with actor and timestamp, and reviewer decisions carry a named identity by design.
05 · Read-only by design
We can observe, not alter
The Atomburst GitHub App holds least-privilege read scopes only. It cannot write to your organization, your repositories, or your settings — the access review reads state, it never changes it.
06 · Minimal collection
Metadata, never your code
Scans read access metadata — members, 2FA status, outside collaborators, app grants — never repository contents. Reviews are kept as your evidence of record until you delete the tenant, which removes them.
Compliance status
Where we are — stated plainly.
We publish status, not aspiration dressed as fact.
Certifications
SOC 2 and ISO/IEC 27001 are on our roadmap and not yet complete. Until they are, our posture is the practices above — ask [email protected] for current status or a completed security questionnaire.
Subprocessors
Railway (hosting & managed Postgres), Cloudflare (DNS & network edge), Stripe (payments — card data never touches Atomburst), GitHub (sign-in identity & read-only org access), Web3Forms (contact-form delivery).
Privacy
What we collect and why, how long we keep it, and how to get it removed — see the privacy policy.
Responsible disclosure
Found something? Tell us.
If you believe you've found a security vulnerability in any Atomburst or NSCA product, we want to hear from you. Report it privately and give us reasonable time to remediate before any public disclosure. We won't pursue legal action against good-faith research that respects user privacy and avoids service disruption.
Report to [email protected].