Security controls and operating safeguards
A concise public description of how Urd Atlas protects authenticated access, credentials, subscriber state and production delivery.
Transport and storage
Public and authenticated web traffic is served over HTTPS. Vercel documents AES-256 encryption at rest for platform data and HTTPS/TLS 1.3 in transit. Clerk's contractual security controls include encryption in transit and at rest for customer data. Supabase provides SSL-capable managed Postgres connectivity and managed encryption controls for sensitive stored secrets.
Upstash is used for bounded rate-limit metadata rather than the subscriber dataset. Upstash documents TLS for Redis traffic. Encryption at rest is a plan-specific Production Pack control, so Urd Atlas does not claim that Upstash data is encrypted at rest unless that account-side add-on is independently verified.
Urd Atlas does not store customer payment-card data directly; Stripe handles payment-card processing.
Authentication and API keys
Clerk provides account authentication and session handling. Subscriber file delivery requires an active entitlement and an API key.
API-key secrets are generated from cryptographically secure random bytes. Urd Atlas stores a salted scrypt hash for verification plus a non-secret prefix and final four characters for identification. The full secret is returned at creation time and is not designed to be recoverable later in plaintext.
Accounts are limited to two non-revoked API keys at a time. Keys can be revoked from the account flow and inactive subscriptions are denied authenticated file access.
Abuse prevention and request controls
Protected routes use entitlement checks, same-origin protection where appropriate, request logging and rate limiting. Production pre-auth rate limiting fails closed if its configured backend is unavailable.
Current public limit semantics are documented at API Rate Limits.
Change and incident process
Production-bound code and methodology changes are tracked in Git and are expected to pass the applicable build, test, audit and publication-integrity gates before release.
Security incidents are handled separately from ordinary data-freshness incidents. Where applicable law requires regulator or affected-user notification, Urd Atlas follows the applicable legal threshold and timing rather than applying one universal notification clock to every operational event.
Persistent customer-impacting incidents should be reflected on Status.
Responsible disclosure
Suspected security vulnerabilities should be reported through the responsible-disclosure process. Do not access other customers' data, perform denial-of-service testing, or exfiltrate data to demonstrate a finding.
Assurance boundary
Urd Atlas maintains SOC2-style internal process documentation for access control, change management, incident response, recovery, vendor review and security-review cadence. This is not a SOC 2 certification, external attestation or formal assurance report.
The statements above distinguish provider-documented platform controls from plan-specific controls. A control that has not been independently verified for the Urd Atlas account is not represented as enabled. This explicit boundary is the current security assurance statement.