Privacy Policy
This policy explains what Atmos collects and why, how long each category is kept and how to exercise your rights.
1. Who is responsible
Atmos Security Consultoria em Ti LTDACNPJ 67.252.845/0001-45
Rua Pais Leme 215, Conj 1713
Pinheiros, São Paulo SP, 05424-150
Brazil
support@atmoslab.dev
For the data we handle to run our own business, such as your account and your billing, we are the controller. For the data your scans upload about your code and your contributors, we act as a processor on your behalf under the Data Processing Addendum, and you are the controller.
Data protection contact: support@atmoslab.dev. This is the communication channel for everything in this policy, including requests about your data, and it reaches the person responsible for personal data at Atmos.
2. What Atmos collects from scans
Scans run on your machine or in your continuous integration, and we never clone your repositories. From your scans, Atmos collects:
- The findings you upload, to show them to your team on the platform and on pull requests. A finding carries its rule identifier, severity and message. It also carries its file path, its line and column numbers and the trace behind it. A one-way hash of the line it was reported on comes with it, to tell findings in the same file apart and to keep tracking a finding when the code around it moves. A dependency finding also carries the package and version, the advisory and the dependency path. The matched source line is included only if you turn snippets on, and a secret value in that line is masked.
- The repository identity, with the branch, commit and pull request a scan ran on, to file the findings under the right project and to apply your plan.
- A record of each scan with the credential that ran it and the CLI version, to apply your plan and to support you.
- One-way hashes of recent committer email addresses, covered in section 3.
- The CVE identifiers among your dependency findings, to return their EPSS scores.
The same list, written for engineers, is in what leaves your machine.
3. Committer email hashes
Atmos collects one-way hashes of the email addresses of the people who committed to your repositories in the last 90 days, to compare the developers active in your repositories with the seats on your plan.
We treat these hashes as personal data, not anonymous data. Someone who already knows an email address can recognize its hash, so the data is pseudonymous, and every right in this policy applies to it.
Why we are allowed to do it. Our lawful basis is legitimate interest, under GDPR Art. 6(1)(f) and LGPD Art. 7, IX, in matching the seats on a plan to the team that uses it. We never contact anyone from this data, and we never use it for marketing, profiling or sale.
If you are a contributor to a repository scanned by Atmos and you want your hash removed, write to support@atmoslab.dev. We will act on that directly, and we will also tell the customer whose workspace holds it, because they are the controller for that data.
4. What else we collect
Account
You sign in with GitHub. Atmos collects your GitHub user identifier, your name or username and your email address. We use them to create your account, to identify you in your workspace and to send you account email. We also keep a record of the version of the Terms you accepted, and the browser of each sign-in, so you can recognize your sessions and end them.
Workspace
Each workspace's name, its members with their roles, and the invitations you send with the email address of each invitee, to run the workspace. The projects you connect and a hash of each workspace token, to authorize the scans that use them.
Machine sign-ins
For each request to sign a machine in, from atmos login, the install scripts or the editor extension, Atmos keeps the network range and the country the request came from, and the name the device gives itself. We use them to show the person who approves the request where it came from, and to warn them when it comes from a different network than the one they are on.
For each machine you sign in, Atmos keeps its name (usually its hostname), a hash of its credential and the dates it was created, last used and revoked. We use them to show you your machine sign-ins and to let you revoke them.
Billing
If you subscribe, our payment processor collects your payment details and your billing address directly, and card numbers never reach our systems. We keep your subscription, your invoices and the tax identification you give us, to bill you and to keep the records fiscal law requires.
Support
What you send us by email or through the contact form, with the name, email address and team size you give us, to answer you and to keep a record of what we agreed.
Logs
Logs of the actions taken on the service, each with the account or credential behind it, the time and the IP address it came from. We use them to operate the service, to investigate abuse and to answer your own security questions about your workspace.
This website
atmoslab.dev and docs.atmoslab.dev set no cookies of their own. The contact page runs a verification check from our cloud infrastructure provider to keep automated messages out, and the check receives your IP address and details of your browser. The platform at app.atmoslab.dev sets only the cookies sign-in needs to keep you signed in.
5. Why we are allowed to process it
| Data | Basis |
|---|---|
| Account, workspace, machine sign-ins and scan data | Performance of the contract with you, GDPR Art. 6(1)(b) and LGPD Art. 7, V. Without it there is no service. |
| Billing records and invoices | Performance of the contract, and compliance with a legal obligation for the fiscal records, GDPR Art. 6(1)(c) and LGPD Art. 7, II. |
| Committer email hashes | Legitimate interest in matching the seats on a plan to the team that uses it, GDPR Art. 6(1)(f) and LGPD Art. 7, IX. See section 3. |
| Audit logs, including IP addresses | Legitimate interest in security, abuse prevention and operating the service, GDPR Art. 6(1)(f) and LGPD Art. 7, IX. |
| Network range and country of a sign-in request | Legitimate interest in security, so the person who approves a sign-in can tell where it came from, GDPR Art. 6(1)(f) and Recital 49, and LGPD Art. 7, IX. |
| Support messages | Performance of the contract and our legitimate interest in answering you. |
| Contact form verification, including IP addresses | Legitimate interest in keeping automated messages out of the contact form, GDPR Art. 6(1)(f) and LGPD Art. 7, IX. |
6. Who we share it with
We do not sell personal data and we do not share it for advertising. We use a short list of service providers to run Atmos, each with a written agreement and access to only what its job needs. The categories we use, and the trust review that shares the current named list, are on the subprocessors page.
There is no AI subprocessor. Atmos never sends customer code, findings or personal data to an AI company, and Atmos never uses anything it holds to train an AI model.
We may also disclose data when the law requires it, and we will tell you first unless we are legally prevented from doing so. If the business is ever sold or merged, data moves with it and this policy continues to apply until it is replaced with notice.
7. Where it is processed
We are established in Brazil and our production systems run in the United States. Transfers out of the European Economic Area and the United Kingdom rely on the European Commission's Standard Contractual Clauses, or on an adequacy decision where one covers the destination. Transfers out of Brazil follow the international transfer rules in LGPD Chapter V.
8. How long we keep it
| Category | Retention |
|---|---|
| Findings and their triage | Until the project or workspace that holds them is deleted, and removal completes within 91 days of the deletion. |
| Scan history: the record of each scan and the report it uploaded | 12 months on Free, and 18 months on Pro and during a trial, or until its project or workspace is deleted if that comes first. |
| Inactive Free workspaces and accounts | An account whose only workspace is its own Free personal workspace is deleted, with that workspace, after 12 months with neither a sign-in nor a scan. Any other Free workspace is deleted after 12 months without a scan. The owners, or the account holder, get an email 30 days before, and section 8 of the Terms sets out the full rule. |
| Source lines, if you turned snippets on | Stored with the finding and deleted with it. |
| Committer email hashes | 90 days after the last scan that included the hash, or until the workspace is deleted if that comes first. |
| Account records | Until the account is deleted. |
| Workspace records | Until the workspace is deleted. |
| Machine sign-ins | Until the account, or the workspace the sign-in acts in, is deleted. |
| Sign-in requests that are never completed | Expire after 15 minutes and are deleted afterwards. |
| Network range and country of a sign-in request | Only while the request is open. |
| Audit logs, including IP addresses | 12 months. |
| Invitations that are never accepted | Expire and are purged, and are removed when the workspace is deleted. |
| Billing and fiscal records | 5 years, which is the retention Brazilian fiscal law requires of us. |
| Support messages | While the conversation is useful, and then deleted on request. |
9. Your rights
Whatever law applies to you, you can ask us to:
- confirm whether we hold data about you, and give you a copy of it,
- correct it when it is wrong or incomplete,
- delete it,
- export it in a portable format,
- restrict or object to processing that rests on legitimate interest,
- tell you who we shared it with, and withdraw a consent you gave, without that affecting what happened before you withdrew it.
The Settings page of the platform lets you download your data and delete your account yourself. For anything else, write to support@atmoslab.dev. We complete erasure requests within 30 days of confirming who you are, and we will tell you if a request takes longer than that and why. There is no charge for a request that is not clearly excessive.
Deleting your account deletes your personal workspace and the workspaces where you are the only member, with their projects, findings and scan history. In the workspaces you share, Atmos removes you and the tokens you created stop working. If you are the only owner of a workspace that has other members, make one of them an owner before you delete your account. Your machine sign-ins are deleted too. What survives is the fiscal record described above, and audit log entries in the workspaces you shared, which are deleted after 12 months.
If we get it wrong, you can complain to the Brazilian data protection authority, the ANPD, or to the supervisory authority where you live. We would rather you told us first.
10. How we protect it
Data is encrypted in transit and at rest, and access to production is limited to the people who need it. Workspace tokens and machine sign-ins can be revoked at any time. No control makes a breach impossible, and if one affects your data we will tell you and the relevant authority as the law requires.
11. Children
Atmos is a tool for professional software development and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe we have, write to us and we will delete it.
12. Changes to this policy
When this policy changes materially we will give notice by email or in the product before the change applies. The date at the top of this page always reflects the version in force.