Data on your infrastructure
In an on-prem install the database, files and the Atlas index live on your servers. We do not receive them.
Security and privacy
You decide where your data lives and who can see it.
This page lists only what the product does today. Each statement is tied to a document or code in our repository.
Your servers
What stays with you
You choose where text goes
Text reaches only the model you configure. Use a model inside your network and nothing leaves it. No employee needs an API key: all model calls go through the company server.
Secrets are stored encrypted
Model provider keys, the directory service password and Business Central secrets are encrypted before they are stored.
Access
How access is enforced
The server decides, not the screen
Roles and permissions are checked on the server for every request. Hiding a button is only a courtesy. A person whose account is disabled in the directory loses access.
Search that respects access
Atlas answers each person only from what they are allowed to read. Private mail stays private to its owner.
Strong sign-in
Windows or directory sign-in, Google, Microsoft, or local accounts with hashed passwords (PBKDF2), lockout after repeated failures and a second factor (TOTP with recovery codes).
Agents on a leash
Reading is free; writing follows each agent's mode; irreversible actions need a person. Personal agents can never post or send. Email text is given to a model only as fenced data.
Audit and lifecycle
What is recorded and how long data stays
Audit log
Admin changes and agent actions are written to an audit log that admins can read. One switch stops every agent.
Files: scan, retention, legal hold
Files are scanned (ClamAV) and quarantined when infected, have quotas and a retention period, go to a 30-day trash, and can be put on legal hold, exported, or deleted on request.
Backups you can test
Backup and restore scripts and a restore check ship with the product, and the admin console shows backup status. See the backup runbook.
Hardened web edge
Security headers, request size limits and rate limits are built in, and sample TLS reverse-proxy configurations (Caddy, nginx) are provided.