Security

1. Our Approach

Security is a first-class concern in how Atomus Dev designs, builds, and ships web applications, mobile apps, and cloud infrastructure for our clients. This page outlines the practices we follow across our own website and the projects we deliver.

2. Infrastructure & Hosting

We build and deploy on established cloud providers, including Amazon Web Services (AWS), and rely on their underlying physical, network, and infrastructure security controls. Where we manage infrastructure directly, we follow the principle of least privilege for access control, and credentials and secrets are never committed to source control.

3. Data in Transit & at Rest

This website, and applications we build for clients, are served over HTTPS/TLS to encrypt data in transit. Where sensitive data is stored, we use the encryption-at-rest capabilities provided by our hosting and database providers, and avoid storing sensitive data we don't need.

4. Application Security Practices

When developing web and mobile applications, we aim to follow secure coding practices, including:

• Guarding against common vulnerabilities such as SQL injection, XSS, and CSRF
• Validating and sanitising input at trust boundaries
• Keeping dependencies and frameworks up to date to reduce exposure to known vulnerabilities
• Using environment variables and secret managers for API keys and credentials rather than hardcoding them
• Enforcing authentication and authorisation checks on any endpoints that handle user or client data

5. This Website

The Atomus Dev website is a Next.js application. Our contact form is processed server-side via a dedicated API route and delivered by email submissions are not stored in a public database, and we do not embed third-party trackers beyond what is disclosed in our Privacy Policy.

6. Mobile Applications

Where mobile apps we build operate fully offline (such as our Dial X app), no user data ever leaves the device, which removes an entire category of transmission and server-side risk. App-specific security and privacy details are published on each app's own privacy policy page.

7. Third-Party Services

We selectively use reputable third-party services (such as cloud hosting, email delivery, and analytics providers) as part of delivering our services. We review the security and privacy posture of any third party before integrating it into a client project, and limit the data shared with each provider to what is strictly necessary.

8. Client Data & Confidentiality

Access to client credentials, source code, and business information is limited to the people directly working on that engagement. We do not reuse client credentials or access outside the scope of the agreed project, and we honour confidentiality obligations set out in our Terms of Service.

9. Responsible Disclosure

If you believe you've discovered a security vulnerability affecting the Atomus Dev website or a product we've built, we want to hear from you.

When reporting, please include where possible:

• A clear description of the vulnerability and its potential impact
• Steps to reproduce the issue
• Any relevant screenshots, logs, or proof-of-concept code

We ask that you act in good faith: avoid accessing, modifying, or deleting data that isn't yours, avoid degrading the availability of our services, and give us reasonable time to investigate and remediate before any public disclosure. We do not currently run a paid bug bounty program, but we will acknowledge and credit valid reports if you'd like.

10. Incident Response

In the event of a security incident affecting client data, we will investigate promptly, take reasonable steps to contain and remediate the issue, and notify affected clients without undue delay in line with our contractual and legal obligations.

11. Changes to This Page

We may update this page as our practices evolve. Material changes will be reflected by an updated “Last updated” date at the top of this page.

12. Contact

For security reports or questions about our security practices, reach us at: