Security
Atashi.com.au Pty. Ltd. ACN 696 804 074
Last updated: [DATE]
This is a template draft prepared for internal review. A qualified Australian lawyer should review this document before it is published or relied upon in production.
We take the security of your data seriously. This page describes how we protect your information, what we have in place today and where we are headed. We believe being clear about both our strengths and our limitations is the right way to earn your trust.
Data residency
Your workspace data (conversations, agent memory, uploaded files, account information) is stored in a Supabase Postgres database hosted on Amazon Web Services in the ap-southeast-2 (Sydney, Australia) region. Your data does not leave Australia for storage.
When you interact with AI agents, your messages are transmitted to third party model providers for processing. These providers are located in the United States. See "Third party AI providers" below for details.
Encryption
At rest. All data stored in our database is encrypted at rest using AES-256 encryption, the industry standard for data at rest protection. BYOK API keys receive an additional layer of envelope encryption with per tenant key isolation — your key is encrypted with a data encryption key, which is itself encrypted with a master key. The master key is managed separately from the database.
In transit. All communication between your browser and our servers is encrypted using TLS 1.2 or higher. All communication between our servers and third party providers (AI model providers, error tracking, infrastructure services) is similarly encrypted in transit.
Access controls
Row level security. Our database enforces row level security policies at the Postgres level. This means the database itself prevents any authenticated request from accessing data belonging to another user, regardless of application logic. This is not just an application layer check — it is a database level guarantee.
Administrative access. During the closed beta, administrative access to the database and infrastructure is restricted to the founding team. All administrative actions are logged. We operate on a least privilege basis: team members only have access to the systems they need to operate the platform.
Authentication
Password security. Passwords are hashed before storage. We never store plain text passwords. Minimum password length is 6 characters (we plan to increase this requirement as the platform matures).
Device verification. When you sign in from a new device, we send a one time verification code to your registered email address. You must enter this code to authorise the new device. This adds a layer of protection against credential stuffing and unauthorised access from unfamiliar devices.
Session management. Sessions automatically expire after 15 minutes of inactivity. You can sign out at any time.
Third party AI providers
Your messages are processed by third party AI model providers. We have selected providers that offer contractual commitments not to use your data for model training under their business and API terms.
Provider isolation. Each user's requests are sent independently to the provider. There is no cross user prompt sharing, batching or pooling that would expose one user's content to another. Agent system prompts and skill definitions are injected server side and are not visible in the responses returned to users.
BYOK key handling
If you bring your own API keys:
- Keys are encrypted at rest using envelope encryption with per tenant key isolation.
- Keys are decrypted only at the moment a request is routed to the provider, in server memory, and are not logged or written to disk in decrypted form.
- You can delete your keys at any time through the Settings panel. Deletion is immediate and irreversible.
- We do not have a mechanism to read your keys in plain text. If you lose a key, you will need to generate a new one from your provider's dashboard.
Incident response
Current posture. During the closed beta, Atashi is operated by a small founding team. Incident response is best effort. We do not currently maintain a formal 24/7 on call rotation or a contractual SLA for incident response times.
What we commit to:
- We will investigate all reported security incidents promptly.
- If we identify a data breach that is likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth).
- We will communicate openly about incidents that affect your data, including what happened, what data was involved and what steps we are taking.
What we do not have yet
We believe honesty about our current limitations builds more trust than vague reassurances. Here is what we are working toward but have not yet achieved:
SOC 2. We do not currently hold SOC 2 Type I or Type II certification. This is on our roadmap for post beta.
ISO 27001. We do not currently hold ISO 27001 certification.
HIPAA. We are not HIPAA compliant. Do not use Atashi for protected health information.
SSO / SAML. We do not currently support single sign on or SAML federation. This is planned for a future release.
Formal penetration testing. We have not yet engaged a third party penetration testing firm. This is planned for before general availability.
Bug bounty programme. We do not currently operate a formal bug bounty programme. If you discover a vulnerability, please report it through our responsible disclosure process below.
Subprocessors
The following third party services process your data on our behalf:
We will update this list and provide notice before adding new subprocessors that handle your personal information.
Responsible disclosure
If you discover a security vulnerability in the Atashi platform, we ask that you report it responsibly:
Email: security@atashi.com
What we ask:
- Provide enough detail for us to understand and reproduce the issue.
- Give us reasonable time to investigate and address the vulnerability before any public disclosure. We ask for a 90 day coordinated disclosure window.
- Do not access, modify or delete data belonging to other users during your research.
What we commit to:
- We will acknowledge your report within 7 days.
- We will not take legal action against researchers who report vulnerabilities in good faith and comply with this disclosure policy.
- We will keep you informed of our progress in addressing the issue.
- We will credit you (if you wish) when the vulnerability is resolved and disclosed.
Contact
Security enquiries: security@atashi.com Privacy enquiries: privacy@atashi.com
Atashi.com.au Pty. Ltd. ACN 696 804 074 Sydney, New South Wales, Australia