Security.

Credentials

API and Suite keys are stored as SHA-256 hashes and shown once at creation. A key that appears in a public place is rotated, with notice first where practicable. Customers can mint replacement keys at any time; a compromised key reported to data@atcstw.com gets a replacement the same business day.

Transport and storage

All services run over TLS. Data at rest is held on Cloudflare's platform (D1/R2) under its encryption defaults. Access to production data systems is role-scoped; bulk data movement runs through gated, logged jobs — the public record of why is the October 2026 write incident, whose corrective controls (write gates, token separation, usage tripwires) are standing practice, described on request to enterprise customers.

Payments

Payments are processed by Stripe. ATCSTW never receives or stores full card numbers.

Compliance posture — stated plainly

SOC 2 is planned, not held. No page on this site claims otherwise. Subprocessors are listed in the Privacy Policy — at publish, Cloudflare and Stripe, complete. Enterprise agreements carry the security terms the parties sign; this page is the public summary, not the contract.

Report a vulnerability

Security reports: data@atcstw.com with "SECURITY" in the subject. We acknowledge within one business day. Good-faith research that respects customer data and service availability is welcome; we ask for a reasonable window to remediate before disclosure, and we credit reporters who want it.