Security
ATOVault is built for teams pursuing federal authorization, so the platform is held to the standards it helps you document. This page describes the controls that are in place today.
Encryption at rest
Every database table and every stored artifact is encrypted with AWS KMS (SSE-KMS) using customer-managed keys. Encryption is enforced at the resource level, not left to the application.
Encryption in transit
All traffic is TLS. The application is served exclusively over HTTPS through CloudFront, and every AWS service call travels over TLS.
Tenant isolation
Every record is partitioned by tenant, and every API request is scoped to the caller’s tenant from their verified token claims. Cross-tenant reads are structurally prevented rather than filtered after the fact.
Authentication and MFA
Identity is managed by Amazon Cognito. Sign-in uses SRP, so your password never leaves your browser and is never transmitted to our servers. Time-based one-time passcode (TOTP) MFA is supported, and can be enforced for all users.
Role-based access control
Five roles (tenant admin, system owner, compliance analyst, developer, auditor) are enforced server side on every endpoint. The auditor role is strictly read-only, so 3PAO assessors can review evidence without any ability to change it.
Web application firewall
AWS WAF sits in front of the application with managed rule sets and rate limiting.
Least-privilege access to your cloud
ATOVault reads your environment through a cross-account IAM role that you deploy and control, scoped to read-only discovery. We never ask for long-lived access keys, and you can revoke access at any time by removing the role.
Audit logging
Privileged actions are recorded to a per-tenant audit log that admins can review in the app. Infrastructure and identity events are captured in AWS CloudTrail.
Secret handling
Credentials and integration tokens live in AWS Secrets Manager, scoped per environment. They are never stored in our source code or in infrastructure state.
Authorization status
ATOVault helps you produce a FedRAMP authorization package. To be clear about our own status: the platform is not itself FedRAMP authorized, and we do not claim a third-party audit we have not completed. We describe the controls we run, and we are happy to walk a security reviewer through any of them.
Reporting a vulnerability
If you believe you have found a security issue, please email [email protected]. Please include enough detail to reproduce the issue. We will acknowledge your report and keep you updated as we investigate. We ask that you give us a reasonable opportunity to remediate before any public disclosure.