Security and data protection

Each customer's environment is separate and single-purpose: your data, processing, secrets, and logs live in an environment shared with no other customer. Data is never moved between customers.

The principle of least privilege applies throughout. Raw data access is closed by default - only designated service accounts can reach it, not people. Every access is traceable.

Your data is not used to train AI models. The AI does not do the math itself: answers are always computed from your actual data, not from estimates or model memory, and every answer shows which data it rests on. Every agent run is logged.

AtlasAction agent boundaries are enforced by infrastructure, not instructions - an agent operates only within the permissions and tools it has been granted, even if it were to err. There are multiple layers of protection:

• An agent can only reach the tools defined for it
• The agent's ERP user account has restricted permissions

Every run is logged: what the agent read, what it did, and why.

Data is stored and processed in the European Union, with two exceptions: the AI analyst's questions and the data needed to answer them are processed by the AI assistant's provider in the United States, and on portal sign-in the user identity is processed by the sign-in service provider, also in the United States. Personal data processing is minimized: Atlas works on business data, not on profiling people. Data processing terms are fixed in the service agreement; when the agreement ends, your data is safely deleted.