We sell security. Ours has to hold up first.
A secure development lifecycle is one where threat modelling, code review, dependency auditing and penetration testing are stages of delivery rather than a certificate collected before launch.
This page sets out how we build, how we handle your data, and how to report a vulnerability to us.
How we build and operate.
Secure development lifecycle
Threat modelling at design, security review at code review, dependency and licence scanning in the pipeline, and secrets kept out of repositories by policy and by automated scanning.
Testing before release
Penetration testing and security review before production release, with findings remediated and retested rather than logged as accepted risk by default.
Least privilege by default
Access is scoped to the engagement and reviewed. Client production credentials stay with the client wherever the work allows it.
Data minimisation
We ask for the least client data an engagement requires. Production data is not copied into development environments; anonymised or synthetic data is used instead.
Confidentiality
NDA by default on every engagement. For regulated and public sector work we support additional confidentiality, background and clearance requirements as the contract sets out.
Handover without lock-in
Source code, infrastructure definitions and documentation transfer to you, so your security team can review, audit and take ownership of everything we built.
Frameworks we design against.
These are the frameworks our engineering and documentation are designed to satisfy, and the ones we support clients through. Listing a framework here describes what we build against — it is not a claim to hold certification against it. Where a tender needs our own certification status stated, ask and we will answer precisely rather than by implication.
- ISO 27001
- SOC 2
- GDPR
- India DPDP Act 2023
- PCI DSS
- HIPAA
- OWASP ASVS
- OWASP Top 10
- NIST CSF
- CIS Benchmarks
- IEC 62443
- WCAG 2.2 AA
Reporting a vulnerability.
If you believe you have found a security issue in a system operated by Atomos Technologies, email care@atomostechnologies.com with the subject SECURITY. Include reproduction steps, the affected URL or endpoint, and the impact you believe it has.
We acknowledge reports within 72 hours and will keep you updated through remediation. We will not pursue action against good-faith research that follows the terms opposite, and we are glad to credit reporters who want it.
Disclosure terms
- Do not access, modify or exfiltrate data that is not yours
- Do not run scanners at a rate that degrades service
- Do not use social engineering or physical intrusion
- Give us reasonable time to remediate before publishing
- Report promptly and in good faith
Security and compliance.
Is Atomos Technologies ISO 27001 certified?
We design and document against ISO 27001, SOC 2 and related frameworks, and we support clients through their own certification. We do not claim certifications on this site. If a tender requires evidence of our own certification status, ask us directly and we will answer precisely.
How do you handle our data during an engagement?
By minimising it. We request the least data the work requires, do not copy production data into development environments, and use anonymised or synthetic data instead. Access is least-privilege, scoped to the engagement, and revoked at the end.
Can you sign our security addendum or DPA?
Yes. We routinely sign NDAs, data processing agreements and security addenda, and we complete vendor security questionnaires. For public sector work we support additional confidentiality and clearance requirements set out in the contract.
What security evidence can you provide for procurement?
Penetration test reports with retest verification, threat models, secure development lifecycle documentation, dependency and licence audits, and architecture security reviews. Where a specific framework is required we support the preparation and evidence-gathering.
How do I report a vulnerability in your systems?
Email care@atomostechnologies.com with the subject SECURITY, including reproduction steps, the affected URL and the impact. We acknowledge within 72 hours. Good-faith research following our disclosure terms will not be pursued.
Do you run background checks on engineers?
Standard verification applies to all engineers. Where a client or a regulated engagement requires additional background checks or clearances, we arrange them as part of the contract before anyone is assigned.
Need our security posture in writing?
We complete vendor security questionnaires, sign DPAs and security addenda, and provide penetration test evidence for procurement.