Atlas Intel Security and Data Protection Overview
Atlas Sales AI LLC · Updated October 29, 2026
This overview summarizes how Atlas Intel protects customer data. The binding terms are in the Atlas Intel Terms of Service and Data Processing Addendum.
Our commitments
- We never sell customer data. Not in identifiable, aggregated, or de-identified form. Not to advertisers, data brokers, or anyone else.
- Only de-identified data improves the product. We may use data stripped of every name, contact detail, and identifying detail to improve our scoring. We never re-identify it, sell it, or share it. We opt out of vendor model training wherever our AI and transcription vendors offer it.
- Your data is yours. You own it, you can export it, and we delete it after you leave.
- No cross-customer exposure. One customer's identifiable data is never shown to, combined with, or used to serve another customer.
How data is protected
| Area | What we do |
|---|---|
| Customer isolation | Every record belongs to one customer account. Database row-level security enforces the boundary on every query, so one customer's users cannot read another's data even if application code has a bug. Automated tests check these rules before every release. |
| Access control | Role-based seats (owner, director, rep, setter). Each person sees only what their role and account allow. Atlas staff access is limited to what operating and supporting the service requires. |
| Encryption | TLS for all data in transit. Encryption at rest on all hosting and database infrastructure. Credentials for connected systems (CRM, call recorder) are separately sealed with public-key encryption and can be opened only by the processing service. |
| Payment card protection | Card numbers spoken on calls are automatically detected and redacted before transcripts are stored, shown, or scored. |
| Data minimization | Where a call recorder provides a secure link, we store the link, not the recording. Access to the recording stays controlled by the customer's recorder. |
| Audit trail | Sensitive actions are logged in a tamper-evident audit log (hash-chained and verified nightly against an off-database record). |
| Monitoring | Automated jobs are monitored around the clock, and failures alert our team immediately. |
| Secure development | Every change goes through code review and automated testing, including tests of the access rules, before it reaches production. Database changes are applied to a separate staging environment first. |
| Credential rotation | Secrets are kept out of source code and are rotated when a vendor reports a risk. |
| Vendors | We use established US-based infrastructure, transcription, AI, email, and billing providers under written agreements. The named list is available to customers on request. |
Data lifecycle
| Stage | What happens |
|---|---|
| Collection | Only from systems the customer connects, using credentials the customer provides and can revoke at any time. |
| Use | Identifiable data is used only to provide the service to that customer. De-identified copies may be used to improve the product. |
| Retention | For as long as the customer's account is active. |
| Single-call deletion | On request, within 10 business days. |
| After cancellation | 30-day export window, then deletion from active systems within 90 days. |
Incident response
If we confirm a security incident affecting a customer's data, we notify that customer within 72 hours with what we know, what we're doing, and what they should do. We help customers meet any notification duties they have.
Compliance
- Atlas acts as a service provider under the California Consumer Privacy Act and comparable state privacy laws. Our Data Processing Addendum includes the required service-provider terms.
- Customers are responsible for call-recording consent. Our Call Recording and Consent Addendum gives them a clear standard and disclosure script.
- Atlas is not a payment processor and does not store payment card data.
Contact
Security questions, questionnaires, or reports: legal@atlassales.io