Security.

Forum Atlas is built on a small, modern, US-hosted stack with least-privilege access and per-tenant isolation at the database layer.

What we ingest

By default, and on every self-serve tier, Forum Atlas synthesizes publicly available information only. We do not connect to or ingest your private systems, and there is no setting on Free, Pro, Team or Business that would let us. Customer-data ingestion is an Enterprise arrangement, handled under a signed contract as an operator-run process; there is no customer-facing ingestion endpoint in the public API today. If your plan does not name it, it is not happening.

Tenant isolation

Customer data is separated at the database with row-level security. Each workspace's reads and writes are scoped to that workspace, enforced in Postgres rather than relying on application code alone.

Authentication

Sign-in is handled by WorkOS, supporting SSO and modern identity flows. Anyone can create an account; what a workspace can read is decided by its plan and enforced in the database. API access uses scoped, revocable keys with per-key rate limits.

Data handling

Data is encrypted in transit with TLS 1.2 or higher and encrypted at rest by our managed infrastructure providers. We use AI providers under API terms intended to prevent customer inputs from being used to train their models, and we do not use a customer's private inputs to train models for other customers. Payment details are handled by Stripe; we never store full card numbers.

Infrastructure

The platform runs on Supabase (Postgres), Modal (compute), and Vercel (web), fronted by Cloudflare for DNS, CDN, and edge protection. Hosting and operation are United States–based. A current list of subprocessors is maintained at Subprocessors.

Reporting a vulnerability

If you believe you've found a security issue, email security@forumatlas.com. We appreciate responsible disclosure and will work with you to validate and address verified reports.