Our approach
Athollus is a business intelligence platform that processes sensitive company information — financial reports, sales and inventory data, CRM exports, and internal documents. We designed the platform so that each customer's data stays within its own isolated environment, access is controlled and logged, and information is encrypted as it moves across the internet. Security is not a single feature; it is a set of practices applied across our architecture, our vendors, and our operations.
Workspace isolation (multi-tenancy)
Every customer receives an isolated company Workspace. Company data is never intentionally shared with other customers. We use logical separation between organizations — tenant isolation — combined with row-level access controls that constrain every data request to the Workspace and user making it. This means that even within our shared infrastructure, one organization's queries and analyses cannot reach another organization's data.
Tenant isolation keeps each organization's data logically separated from others.
Row-level access controls enforce, at the database layer, that a user can only read or write rows belonging to their Workspace and permitted scope.
Workspace-scoped processing ensures AI interactions, Company Memory, and reports are associated with — and confined to — the Workspace in which they are created.
Encryption
We use encrypted connections (HTTPS/TLS) to protect data as it travels between your browser or connected services and Athollus. Data stored in our infrastructure is held with our cloud data provider using its storage protections. Together, encryption in transit and secure storage reduce the risk of interception or unauthorized access to your information.
Authentication and access control
Access to a Workspace requires authentication. We rely on a dedicated authentication provider to manage sign-in and credentials; passwords are never stored in plain text and are protected as salted hashes by that provider. Within a Workspace, administrators control which Authorized Users can access the environment and what they can do, so access follows the principle of least privilege.
Account authentication verifies the identity of each user before granting access.
Role and permission controls let customer administrators decide who can view, edit, or share.
Login history and security logs record sign-in activity to support monitoring and investigation of suspicious behavior.
Secure file sharing
Athollus lets authorized users share files outside their organization using controlled links while keeping the underlying file in private storage. The sharing system currently includes several safeguards:
Hashed secure tokens — shared links use cryptographically generated tokens, and Athollus stores the corresponding token values in hashed form rather than as guessable identifiers.
Revocable links — authorized workspace administrators can revoke a shared link to prevent further access through that link.
Deletion invalidation — deleting the underlying file invalidates access through its associated sharing link.
Tenant-scoped management — creation and management of sharing links remain subject to the permissions and company boundaries of the originating Workspace.
Private underlying storage — sharing a file does not make the underlying storage bucket public; external access is provided only through the controlled sharing mechanism.
Logging and monitoring
We maintain audit and security logs covering authentication events and key operational activity. These logs help us detect unusual behavior, investigate potential incidents, and support accountability. Diagnostic telemetry (such as error logs and performance metrics) helps us keep the platform reliable and identify problems quickly.
AI processing and your data
When you use AI features, your prompts and the relevant context from your Workspace are sent to our AI provider solely to generate your response. We do not use your business content to train foundation models for other customers, and our AI provider operates under commitments not to use business inputs to train its general models. AI Output is analysis and recommendation only — it does not make decisions for you, and you should review Output before relying on it. For more detail on how AI interactions are stored and used, see our Privacy Policy.
Our infrastructure and subprocessors
We build on established infrastructure providers and limit the vendors that can process your data. Each vendor processes information only on our behalf, under contract, and only to help deliver the Services. Our current key providers are:
Supabase — database, authentication, and file storage.
Anthropic — AI processing.
Google — the Google Sheets integration, for customers who connect it.
Stripe — payment processing, when paid features are enabled.
We maintain a current list of subprocessors and update it as our stack evolves. For an up-to-date list, contact us at security@athollus.com.
Data retention and deletion
We keep your data for as long as you maintain an active account, and we delete or de-identify it after account closure as described in our Privacy Policy, except where we must retain limited records to meet legal obligations. Deleted data may persist in encrypted backups until those backups expire on their normal cycle. If you need data deleted, you can use in-product controls where available or contact us.
Your role in keeping data secure
Security is a shared responsibility. You can help protect your organization by keeping credentials confidential, granting Workspace access only to people who need it, promptly removing users who should no longer have access, revoking shared links when they are no longer needed, and being careful about the data you choose to upload or connect. We recommend using strong, unique passwords and enabling any additional account-protection features we offer.
Responsible disclosure
We welcome reports from security researchers and customers. If you believe you have found a vulnerability or a security issue, please contact us at security@athollus.com with details so we can investigate and respond. We ask that you give us a reasonable opportunity to address an issue before disclosing it publicly, and that testing does not access, modify, or delete data that is not yours.
A note on certifications
We describe the security measures we actually have in place today. Athollus does not currently claim formal security certifications (such as SOC 2 or ISO 27001) unless and until we have completed and can evidence them. As we mature our program, we will update this page. If your organization requires specific attestations, contact us to discuss where we are in that process.
Contact
Security questions, vulnerability reports, and requests for our current subprocessor list can be sent to security@athollus.com.