Security you can explain to auditors
Atlas orchestrates agents — you decide where secrets live, what can run, and who must approve it. No root keys required.
Credential custody
Your keys. Your vault. Your runner.
Skeptical about handing over SSH keys? Choose how much trust you place in Atlas — from zero custody to encrypted dedicated keypairs.
Customer-hosted runner
Run the Atlas sidecar in your VPC. SSH keys and agents never leave your network — Atlas handles orchestration only.
Runner-local keys
Atlas stores a reference, not the private key. Secrets stay on your runner and are resolved when work runs.
Vault references
Point at HashiCorp Vault, AWS Secrets Manager, or your own secrets store. Atlas stores pointers, not secret values.
Atlas-generated keypairs
Dedicated SSH keys for a low-privilege user you create — add only the public key to your server.
Revocable by you: Remove the public key from your server, delete the private key on your runner, or revoke the vault secret — access stops immediately, without waiting on Atlas.
Tenant isolation
- Dedicated database per organisation — no shared data between customers.
- Per-tenant encryption keys provisioned automatically at signup.
- Subdomain-scoped workspaces with isolated artifact storage.
Identity & access
- GitHub and Google SSO — no email/password registration in production.
- TOTP MFA and passkeys on tenant and admin routes.
- Role-based access: viewer, operator, approver, and tenant-admin tiers.
Secrets & transport
- Flexible credential modes: runner-local keys, vault references, or encrypted Atlas keypairs.
- mTLS between Atlas and your customer-hosted runner.
- Cursor API keys stored encrypted with rotation support in the UI.
Governance & audit
- Hash-chained, tamper-evident audit logs with export and retention policies.
- Human-in-the-loop approval gates and freeze windows for production.
- SSH command allowlists and server-side access controls you can revoke instantly.
Defense in depth: Sign-in rate limiting, webhook signature verification, session hardening, audit events that never log secret values, and configurable signup approval give platform operators full control over who gets in and what agents can do.
Progressive trust
Adopt at your own pace
Start with cloud agents and pull requests. Add read-only SSH on staging. Move to a customer-hosted runner when you are ready for zero custody.
Cloud PRs
GitHub repos, no SSH
Read-only SSH
Staging investigate only
Your runner
Sidecar in your VPC
Vault refs
Secrets stay in your store
Prod remediate
Approvals + freeze windows
Ready to put agents to work — safely?
Create your organisation in minutes. Connect your environments, tell Atlas what to watch for, and let Cursor agents handle the rest while you stay in control.