Security

Effective date: October 29, 2026

Keeping your account and your files safe is the most important thing we do. This page describes the measures that protect Atlandrak and what you can do to stay safe.

Infrastructure

• Atlandrak runs on managed cloud infrastructure with redundant servers, automatic security patches, private networking and daily encrypted database backups.
• Production access is limited to the people who operate the service, protected with strong multi-factor sign-in, and every administrative action is logged by our cloud provider.
• Secrets such as keys and passwords are stored in a dedicated secret manager, never in source code. Storage keys are scoped to the minimum permissions and rotated.

Data protection

• All traffic uses HTTPS with modern TLS, and browsers are told to always use HTTPS (HSTS).
• Files are encrypted at rest with AES-256. The database and its backups are encrypted at rest.
• Row-level security in the database isolates each account, so requests can only reach the data of the signed-in person or what was shared with them.
• Files are delivered through Atlandrak after checking permission on every request; direct storage links are never given to browsers.
• Uploaded files that could run code in the browser are always downloaded instead of displayed, with protective security headers.

Application security

• Session cookies are HTTP-only, secure and limited to Atlandrak sites. Requests that change data are checked against cross-site request forgery.
• Rate limits protect sign-in, posting, messaging and the contact form against abuse.
• Every new feature is reviewed and tested internally before it is released to everyone.
• We never ask for your password: you sign in through your chosen provider.

What you can do

• Protect the account you use to sign in with a strong password and two-step verification.
• Use the Security card on your dashboard or Account to sign out of other devices if you lose one.
• Be careful with links and files from people you don't know. Atlandrak will never ask you for payment details in a message.
• Report suspicious messages, profiles or listings with the Report option.

Responsible disclosure

If you believe you have found a security vulnerability in Atlandrak, please tell us through the contact form (topic "Security") or at atlandrak@gmail.com, with enough detail for us to reproduce it. We ask that you:

• give us reasonable time to fix the issue before making it public;
• only test against your own accounts and data, and never access, change or delete other people's data;
• don't perform denial-of-service attacks, spam, social engineering or physical attacks;
• stop and tell us as soon as you encounter personal data.

We won't take legal action against researchers who follow these rules in good faith, we will keep you informed while we fix the issue, and we will credit you if you wish.

Incident response

If a security incident affects your information, we contain it, investigate it, notify affected people and the National Privacy Commission within 72 hours when required, and publish what we changed to prevent it from happening again.