Security

Security is fundamental to Atellier. Below is a summary of the technical and organisational measures we maintain. The corresponding contractual commitments are in our DPA Annex II.

Shared Responsibility

Security is a partnership. Atellier is responsible for the platform — infrastructure, encryption, RLS isolation, vulnerability management, and incident response. Customer is responsible for account hygiene (strong passwords, MFA, role assignments, off-boarding), the legality and accuracy of data uploaded, third-party integrations enabled by Customer, and compliance with applicable law for communications Customer initiates through the Service.

Infrastructure

Atellier runs on Supabase, hosted on Amazon Web Services (AWS) in the United States. AWS data centers hold SOC 2 Type II and ISO 27001 attestations. Cloudflare provides CDN, DNS, and DDoS protection.

Encryption

• In transit — TLS 1.2+ everywhere; HSTS on public hostnames.
• At rest — AES-256 for databases, file storage, and backups.
• Backups — encrypted; geographically separated; 30-day retention; quarterly restore tests.
• Secrets — application secrets stored in managed vaults; rotated on a defined cadence and on personnel changes.

Authentication & Access

• Email/password with strong password requirements and breach-list checking;
• Google OAuth available for end users and customer portals;
• MFA available to all users; required for platform administrators;
• SSO (SAML/OIDC) available on enterprise plans;
• Granular role-based access control with per-app permissions;
• Session tokens with automatic refresh and revocation; suspicious-activity alerts.

Data Isolation

Every business record is scoped to organization_id and protected by PostgreSQL Row-Level Security policies enforced at the database layer — not just application code. Cross-tenant access is structurally prevented.

Application Security

• Input validation with Zod schemas and server-side enforcement;
• XSS protection (DOMPurify, CSP headers, server-side sanitization);
• CSRF mitigations via SameSite cookies and origin checks;
• SQL injection prevented via parameterized queries (Supabase client / RPCs);
• Rate limiting and abuse-monitoring on public endpoints;
• Automated dependency scanning and prompt patching of critical CVEs.

Vendor Risk

Each sub-processor is reviewed before onboarding (security posture, certifications, DPA terms) and annually thereafter. The current list is published at /subprocessors.

Vulnerability Management & Testing

• Continuous automated dependency vulnerability scanning;
• Static analysis on the application and edge functions;
• Periodic third-party penetration testing;
• Patch SLA targets: critical 7 days, high 30 days, medium 90 days.

Incident Response & Breach Notification

We maintain a documented incident response plan with severity tiers, on-call rotations, and post- incident reviews. In the event of a Personal Data Breach affecting Customer Data, Atellier will notify the affected Customer without undue delay and in any event within 72 hours of becoming aware (see DPA §10).

Compliance Posture

• SOC 2 Type II — controls in place; formal audit on roadmap.
• ISO 27001 — controls aligned; certification on roadmap.
• PCI DSS — Atellier is out of scope; payment data is handled directly by Stripe (a Level 1 PCI Service Provider) and never touches Atellier servers.
• HIPAA — Atellier is not a HIPAA Business Associate. Do not upload Protected Health Information.
• FERPA — Atellier is not designed for educational records covered by FERPA.

Responsible Disclosure

Report vulnerabilities to hello@meonneon.com with the subject "Security Vulnerability Report." Our targets: acknowledge within 48 hours, validate within 7 days, and remediate critical issues within 90 days. We do not pursue legal action against good-faith researchers who follow this program (no testing of other customers' data, no public disclosure before a fix is released, no DoS testing).

Contact

Security inquiries: hello@meonneon.com