The most sensitive information there is, protected like it.

What Atlas holds

Atlas keeps the kind of information a family only shares once, and it is built to protect it accordingly.

• Confidential: names, emails, phone numbers, home addresses, dates of birth.
• Restricted: Social Security numbers, and the medical, financial, and personal information inside home study documents.

Encryption

• In transit: all traffic uses TLS. Insecure, non-HTTPS requests to file storage are rejected outright.
• At rest: all data is encrypted with AES-256 across the database and file storage.
• Social Security numbers get a second, independent layer of encryption with a dedicated, automatically rotating key. The database stores only ciphertext, so even direct database access never reveals an SSN, and every decrypt is logged.
• Sensitive documents are encrypted with their own separate, rotating key. It can be rotated or revoked to cut off access instantly, and any write to a sensitive path that is not encrypted is rejected.
• Duplicate applicants can be matched by SSN using a one-way keyed hash, so matching never requires storing a readable Social Security number.

Document storage

• Home studies and uploaded files are private and never publicly reachable.
• Files are served only through the application to signed-in staff. The storage location is never exposed to the browser.
• Storage is versioned, so accidental or malicious deletion is recoverable, and replicated to a second U.S. region.

Access control

• Every staff member has an individual account. No shared logins.
• Role-based permissions (admin, caseworker, read-only) limit what each person can see and do.
• Two-factor authentication is required on every account, using any standard authenticator app or a code sent by email.
• A trusted device is remembered for seven days; a new device or the expiry re-prompts.
• Sessions time out after four hours of inactivity and end after twelve hours regardless, so a forgotten tab on a shared computer cannot stay signed in.
• Changing a password or resetting someone’s two-factor authentication signs out every other device for that account immediately.
• Passwords are stored only as one-way hashes, and are checked against known breached-password lists when set.

Audit logging

• Every view of a Social Security number is logged with who viewed it, when, and from what IP address.
• Two-factor enrollment, verification, and admin resets are logged.
• Every document opened, downloaded, or previewed is recorded with who, when, and from what IP address, and bulk exports are recorded per document before any file is sent.
• Document access is rate-limited per person per hour, so a compromised account cannot drain the library at speed.
• Changes to cases and records are tracked in an activity history.

Monitoring and alerting

• Continuous threat detection analyzes account activity for anomalies and known attack patterns, with findings reported every six hours.
• An external health check probes the application every thirty seconds from multiple regions and alerts on downtime and recovery.

Infrastructure

• Runs on AWS, Supabase, and Vercel, all SOC 2-certified providers used widely by healthcare and financial organizations.
• All data is stored within the United States.
• The application connects to the database over verified TLS with a pinned certificate authority, so the connection cannot be intercepted or impersonated.
• Each part of the system holds its own narrowly scoped credentials. The public website, for example, can encrypt data but cannot decrypt it, and cannot reach backups at all.
• Full database snapshots every six hours into separate, isolated storage that the application cannot reach, kept for 60 days, plus the provider’s own daily backups.
• The restore path is rehearsed, not assumed. A complete restore into a scratch database is performed and verified on a schedule, most recently against 226,000 records.
• File storage is versioned and replicated to a second U.S. region.

Resilience and response

• Written incident-response and disaster-recovery plans are maintained, including breach-notification procedures for the states where client agencies operate.
• Atlas was put through a full security audit in August 2026. Every finding was resolved, and the fixes were then audited again by independent review, which found and corrected further issues introduced by the first round of work.
• Software dependencies are monitored continuously for known vulnerabilities. Each one is assessed for whether it is actually reachable in Atlas, and patched on that basis rather than blindly.