Security

Identity & Access Management

Implemented

AtlasGTM authenticates users and enforces role-based permissions with a capability catalog, groups, and per-user grants. Sensitive actions stay unavailable until they are explicitly granted.

Least Privilege

Implemented

Access is limited to the roles, groups, and capabilities granted to each user. Privileged security capabilities cannot be enabled by default.

Authentication & MFA

Partially implemented

Users can sign in with Google, which supports multi-factor authentication at the identity provider. Email-and-password sign-in does not currently require a second factor.

Secrets Management

Partially implemented

Selected credentials, including payment and AI-provider secrets, are stored encrypted at rest and used only by authorized application components.

Infrastructure & Network Security

Implemented

AtlasGTM operates on Google Cloud. Application and data access is limited to the application and authorized operators.

Encryption

Implemented

Public and application hosts are served over HTTPS (TLS). Selected application secrets are encrypted at rest.

Logging & Monitoring

Implemented

Platform activity, developer API requests, and governance events are written to dedicated audit logs used to investigate security and operational issues.

Vulnerability Management

In progress

Vulnerability tracking and remediation are part of AtlasGTM’s security program and SOC 2 preparation.

Secure Software Development

Implemented

Application changes are developed and reviewed through a controlled process before they reach production.

API authentication (API keys)

Implemented

External API requests are authenticated with API credentials that are stored securely.

API authorization / scopes

Implemented

API keys are limited to assigned scopes. Privileged scopes cannot be self-granted.

API rate limiting

Implemented

API requests are subject to rate limiting and abuse protections.

OAuth (MCP clients)

Implemented

MCP clients authenticate with an OAuth 2.1 authorization server, including PKCE and dynamic client registration.

Webhooks

Partially implemented

Outbound webhooks are signed so receivers can verify AtlasGTM as the sender.

Customer-level / connector permissions

Implemented

Access is limited by company membership and granted connector permissions.