Security
A practical look at how your data and your visitors' data are protected on Attlas, no marketing badges, just what's actually in place.
Encryption in transit
Every connection to Attlas, the dashboard, the public chat pages, and our APIs, is served over HTTPS/TLS. Unencrypted traffic is not accepted.
Encryption at rest
Our database runs on Supabase, whose storage is encrypted at rest at the infrastructure level. On top of that, visitor contact details (email, phone, WhatsApp number) collected through lead forms and bookings are encrypted at the application level with AES-256-GCM before they ever reach the database, lookups use a separate cryptographic hash, so the plaintext value is never used to search or match records.
Access control
Every table is protected by Postgres row-level security scoped to your workspace: your data is isolated from every other workspace at the database level, not just in application logic.
Infrastructure
Attlas runs on established providers, Supabase for the database and file storage, Vercel for hosting, who maintain their own security and compliance programs. We do not run our own servers.
Questions or a report
If you have a security question or want to report a vulnerability, email us at hello@attlas.so.