Security & Trust

Your data, handled with care.

Atlasweave processes sensitive business documents. Here is where the data lives, who can reach it, and how long we keep it.

At a glance

What we do to protect your data.

Your material goes in, your Atlas comes out, and both stay inside the EU region. Nothing you give us is used to train or fine-tune a model.

Data region: EU (eu-west-1, Ireland)
Encryption at rest: AES-256 via AWS KMS (customer-managed and AWS-managed keys)
Encryption in transit: TLS 1.2+ enforced on all endpoints
Authentication: AWS Cognito - MFA required in production (TOTP)
Audit logging: CloudTrail, tamper-evident and immutable (S3 Object Lock), retained 7 years

Policy documents

Compliance documentation.

Our sub-processor register is public. The policies summarised below are version-controlled internally and shared in full on request - email security@atlasweave.ai.

Sub-Processor Register →

Every third party that handles customer data - AWS, Amazon Bedrock, and Langfuse for redacted traces - plus GitHub, which handles none. Purpose, data received and region for each.
Encryption & Key Management

AES-256 at rest through AWS KMS, TLS 1.2+ in transit, and customer-managed keys for the audit log and event-log signing. Symmetric keys rotate annually. Signing keys follow a documented annual procedure that keeps historical records verifiable rather than invalidating them.

Full policy available on request
Data Retention

Source documents are kept for two years and working session data for 90 days. Canvas checkpoints are held for seven years to support the audit trail. You can request deletion of your data at any time.

Full policy available on request

Your data, handled with care.

What we do to protect your data.

Compliance documentation.

Sub-Processor Register →

Encryption & Key Management

Data Retention

Security enquiries.