Skip to content
Subatomic

Subatomic Trust Center

Security you can verify.

How Subatomic protects your data, where we stand on compliance, who processes your information and where your security team can find our reports.

Sign in to view documentsReport a vulnerability
  • SOC 2 Type IIIn progress
  • NIST CSF 2.0Implemented
  • OWASP Top 10Implemented

Certifications

Audit and certification status

Third-party audits and attestations Subatomic is actively pursuing. Only certifications backed by an independent audit report appear here.

In progress

AICPA / Trust Services Criteria

SOC 2 Type II

Certification

Independent third-party audit against the Trust Services Criteria. Subatomic is actively building toward SOC 2 Type II attestation, targeting report issuance in 2026.

SecurityAvailabilityConfidentiality

Security Practices

Frameworks we have implemented

Security frameworks that guide how Subatomic's program is structured and applied across client implementations. These are implemented practices, not certifications or licenses.

Implemented

National Institute of Standards and Technology

NIST CSF 2.0

Practice

Subatomic's security program is structured around the six CSF 2.0 core functions: Govern, Identify, Protect, Detect, Respond, and Recover. This is an implemented practice, not a certification.

GovernIdentifyProtectDetectRespondRecover
Implemented

Open Worldwide Application Security Project

OWASP Top 10

Practice

Development and security teams apply OWASP Top 10 guidance across the software delivery lifecycle, covering injection, broken access control, cryptographic failures, and logging. This is a security practice, not a certification.

Application SecuritySecure Development

Security controls

Protection at every layer

The safeguards that are in place today, from infrastructure to how we ship code.

Infrastructure & network
Where the platform runs and how it is isolated.
  • Hosted on Microsoft Azure with managed PostgreSQL.
  • Database connections require SSL/TLS.
  • Database access is restricted by firewall allow-lists.
  • Production, staging and local environments are kept separate.
Identity & access
Who can sign in and what they can reach.
  • Central sign-in with enforced password policy, multi-factor authentication and rotation.
  • Signed, expiring access tokens validated for issuer and audience.
  • Tenant isolation: users only reach the environments they are authorized for.
  • Service credentials stay on the server and are never exposed to browsers.
Data protection
How customer data is stored and handled.
  • Encryption in transit over HTTPS/TLS.
  • Encryption at rest provided by Azure managed storage and database services.
  • Backups and point-in-time restore points are taken before schema changes.
  • Secrets are kept out of source control and logs avoid personal data.
Application security
Hardening of the apps and APIs themselves.
  • Input validated on every API request and response boundary.
  • Strict CORS allow-list and standard security headers (HSTS, no-sniff, frame denial).
  • Dependencies scanned for known vulnerabilities (pip-audit, osv-scanner, Trivy).
Secure development
How changes reach production.
  • Every change lands through a pull request into develop, then staging, then main.
  • Automated checks on each PR, including a database migration drift gate.
  • Reproducible builds from committed lockfiles.
  • Structured logs with request IDs for traceability.

System status

Live platform health

A real-time check against the Trust Center API.

FAQ

Common security questions

Found a vulnerability?

Email the details and steps to reproduce. Please give us a reasonable time to fix the issue before disclosing it publicly.

security@getsubatomic.ai