Snapshot 214781
Normalized text
Scripts and page chrome removed; this is what change detection compares.
AtlasGTM Trust Center Security Last updated: September 2026 How AtlasGTM approaches identity, encryption, logging, and API security. Identity & Access Management Implemented AtlasGTM authenticates users and enforces role-based permissions with a capability catalog, groups, and per-user grants. Sensitive actions stay unavailable until they are explicitly granted. Least Privilege Implemented Access is limited to the roles, groups, and capabilities granted to each user. Privileged security capabilities cannot be enabled by default. Authentication & MFA Partially implemented Users can sign in with Google, which supports multi-factor authentication at the identity provider. Email-and-password sign-in does not currently require a second factor. Secrets Management Partially implemented Selected credentials, including payment and AI-provider secrets, are stored encrypted at rest and used only by authorized application components. Infrastructure & Network Security Implemented AtlasGTM operates on Google Cloud. Application and data access is limited to the application and authorized operators. Encryption Implemented Public and application hosts are served over HTTPS (TLS). Selected application secrets are encrypted at rest. Logging & Monitoring Implemented Platform activity, developer API requests, and governance events are written to dedicated audit logs used to investigate security and operational issues. Vulnerability Management In progress Vulnerability tracking and remediation are part of AtlasGTM’s security program and SOC 2 preparation. Secure Software Development Implemented Application changes are developed and reviewed through a controlled process before they reach production. API & integration security API authentication (API keys) Implemented External API requests are authenticated with API credentials that are stored securely. API authorization / scopes Implemented API keys are limited to assigned scopes. Privileged scopes cannot be self-granted. API rate limiting Implemented API requests are subject to rate limiting and abuse protections. OAuth (MCP clients) Implemented MCP clients authenticate with an OAuth 2.1 authorization server, including PKCE and dynamic client registration. Webhooks Partially implemented Outbound webhooks are signed so receivers can verify AtlasGTM as the sender. Customer-level / connector permissions Implemented Access is limited by company membership and granted connector permissions.