Privacy Policy

Information you give us. When you request a demo or contact us, we collect what you send: your name, your agency, your email, an optional phone number, and your message. We use it only to reply to you and to set up a conversation about Atlas.

Information your agency puts into Atlas. When an agency uses Atlas, it stores records about the families it serves (applicants, children, birth parents, cases, documents, and notes). That data belongs to the agency. We hold and process it on the agency's behalf and only to provide the service. We do not sell it, and we do not use it for advertising or share it with anyone the agency has not authorized.

Everything is encrypted in transit (TLS) and at rest (AES-256). Social Security numbers get a second, independent layer of encryption using a dedicated, automatically rotating key, so the database stores only ciphertext and even direct database access never reveals an SSN. Sensitive documents, like home studies, are encrypted with their own separate key, kept private, served only to signed-in staff, and never exposed to the open web.

Every person has an individual account with role-based permissions, two-factor authentication is required on every account, sessions time out after inactivity, and passwords are stored only as one-way hashes. The system logs who viewed a Social Security number and when, and tracks changes to records over time.

Backups run daily with point-in-time recovery, files are versioned and replicated to a second U.S. region, and deletions are recoverable rather than instant and permanent. We maintain written incident-response and disaster-recovery plans, including breach-notification procedures for the states where client agencies operate.

Atlas runs on AWS, Supabase, and Vercel, all SOC 2-certified providers used widely by healthcare and financial organizations, and all data is stored within the United States. Each provider is bound to handle the data only as needed to run the service, and an agency can request the current list at any time.

Atlas follows HIPAA-aligned safeguards, encryption, access controls, and audit logging. We do not claim a formal HIPAA certification.

We keep an agency's data for as long as the agency uses Atlas. If an agency stops using Atlas, we return or delete its data on request, and never keep it longer than needed to meet a legal obligation. Demo and contact messages are kept only as long as needed to follow up.

An agency can access, correct, export, or delete its data at any time. If you are a family whose information an agency has stored in Atlas, please contact that agency directly, since the data is theirs to manage. You can also reach us with any question using the contact below.

This website uses Google Analytics to understand how visitors use it, things like which pages are read and roughly where visitors come from. It does not run advertising trackers, and we do not sell or share visitor information.

Questions about this policy or your data: info@atlasadoption.com.