Evidence over claims, applied to security
A plain-language summary of ATPX's actual security posture — including what's still in progress. Nothing below is aspirational.
Authentication
Passwords hashed with scrypt, never stored in plaintext. Session tokens are hashed at rest, not stored raw, and use HttpOnly, SameSite cookies.
Two-factor authentication
TOTP-based 2FA is available account-wide with self-service enrollment, backup codes, and disable — not a partial or admin-only feature.
Role-based access control
Every permission-gated action is enforced server-side against the authenticated session's actual role — UI hiding is never the only control.
Tenant isolation
Tenant-scoped data is filtered by the authenticated session's tenant in the query itself, not only at the route layer. Cross-tenant reads return "not found," never a distinguishable error, so a wrong ID can't be told apart from someone else's real one.
Tamper-evident audit log
Every significant action is recorded in a hash-chained, checkpointed audit log designed to make undetected tampering with historical entries mathematically difficult, with independent verification and key rotation.
Least-privilege connectors
REST/webhook/S3 connectors validate destinations against SSRF (no reaching private/internal addresses) and sign outbound requests rather than trusting configuration alone.
Rate limiting
Authentication and signup endpoints are rate-limited against brute-force and abuse.
Automated backups
Regular, checksum-verified backups with a documented, drilled restore procedure.
Stated honestly: what's still in progress
Inbound connector webhooks are authenticated by signature but don't yet have replay-window protection — a captured, valid request could theoretically be replayed. Live payment webhook replay protection is being built alongside Stripe activation. Off-site backup storage and continuous production monitoring/alerting are on the near-term roadmap, not yet live. Rate limiting is currently per-process rather than distributed across a multi-instance deployment.
Full detail is maintained in the project's own engineering documentation and re-verified against source rather than assumed — ask via Support if you need specifics for a security review.
Report a vulnerability
Found a security issue? We want to know. Reach out through Support with details and we'll respond promptly.