How We Protect Your Data

Every record in Atlant that belongs to an organisation — projects, uploaded documents, BOQs, BOMs, RFQs, quotes, purchase orders, messages and audit entries — carries the organisation's identifier, and every read and write is checked against the caller's verified identity before it is served.

That check happens on the server, against the security rules attached to the data store, and it happens on every request. Hiding a button or a route in the interface is not what keeps your data private; the request itself is rejected if the caller's organisation does not match the record's organisation. A user from another organisation who guessed a project's identifier and called the API directly would receive nothing.

The same rule governs individual (non-organisation) accounts: they have no organisation identifier, so every organisation-scoped read is denied to them by construction, not by omission from the menu.

Sign-in is handled by Firebase Authentication with email and password, plus time-based one-time password (TOTP) multi-factor authentication. Your MFA secret is stored server-side and is never exposed to the browser after enrolment.

Each request to a server function carries a signed identity token. The server verifies the token's signature and expiry, loads your account record, and re-derives your organisation, role and account type from the database — it does not trust anything the browser claims about who you are.

Isolation between organisations is the outer boundary. Inside your organisation, access is further limited by the role your Admin assigned:

• Admin — manages the organisation, users, roles and invitations.
• Procurement Manager — runs RFQs, quotations, awards and purchase orders.
• Engineer / Technical Reviewer — works on BOQs, BOMs and technical review gates.
• Finance Lead — sees and approves commercial and purchase-order records.
• Viewer — read-only.

Role checks are applied in the server function that performs the action, not only in the interface that offers it. Invitations are single-use links that expire, and they bind the new user to your organisation and the role you chose.

Actions that change state or expose information — stage transitions, BOQ and BOM approvals, RFQ awards, purchase-order approvals, supplier verification and suspension, agent runs and sign-offs — are written to an append-only audit log with the acting user, the organisation, the target record and a timestamp.

Audit entries are written by the server as part of the action, so an action cannot be performed without producing its record. Administrators can review this trail for their own organisation; the platform team can review it for governance and abuse investigations.

Atlant AI selects the appropriate capability for each feature, including document understanding, generation, tender risk analysis, project status and early-warning synthesis.

Content is sent to a model only when you trigger the feature that needs it, and only the content that feature needs. A tender you upload for the Tender AI Agent is sent to perform that extraction — it is not swept into an unrelated background process, not used to answer another organisation's question, and not shared across tenants.

Retrieval used to ground agent answers is tenant-scoped: the index a model can draw on is filtered to your organisation's own documents before the request is made. Every agent call is counted and recorded against your organisation for usage governance.

Atlant AI routes work according to task complexity. Structured document analysis, generation, complex reasoning, negotiation strategy and multi-step planning remain part of one consistent Atlant Assistant experience.

Uploaded documents — tenders, drawings, specifications, contracts and project images — are held in private storage buckets. They are not publicly addressable: access is served through the application after the same identity, organisation and role checks described above, using short-lived links rather than permanent public URLs. Marketplace listing images are the deliberate exception, because a published listing is meant to be seen.

We would rather be precise than impressive. Atlant does not currently hold SOC 2, ISO 27001 or any other third-party security certification, and we do not describe the platform as certified or audited. Where a control exists, this page describes it; where one does not exist yet, we have not implied it.

If you are evaluating Atlant and need specific assurances, architecture detail or a security questionnaire completed, write to contact-us@atlant.com and we will answer directly.

If you believe you have found a security issue, email contact-us@atlant.com with enough detail to reproduce it. Please do not test against other organisations' data. We will acknowledge your report and keep you informed while we investigate.