Atlas United is an early-stage company. The compliance program is being built deliberately, in the order enterprise customers actually ask for. Below is the honest current state and the roadmap. We will mark every certification as achieved only after the audit closes — never before.
Items marked planned are on the roadmap with an estimated timeframe. They are not yet in effect. We do not advertise certifications we do not have.
14 SOC 2 policies authored. Currently ~35% ready; closing remaining free-tier gaps moves us to ~70% across the board. Type I targeted before first enterprise pilot; Type II follows after a 6–12 month observation period.
Pursued only when a federal sponsoring agency engages. Long timeline; not actively in process today.
~30% ready. Controls reuse SOC 2 evidence. Final scope decided based on first enterprise customer's preference.
BAA template available now for life-and-health customers. ~30% technical readiness today; reachable to ~80% with focused work. Azure carries a HIPAA-eligible BAA we inherit from.
California consumer data rights honored. No data is sold or shared for advertising. Privacy policy published.
Standard Contractual Clauses available for any EU data processing. EU data residency on request when needed.
Internal controls ~40% mapped to the 800-53 Moderate baseline. Reusable evidence for both SOC 2 and a future FedRAMP track. SSP draft in progress.
Quarterly external scanning (SSL Labs, nuclei, nmap) live today: 0 findings at low/medium/high/critical, SSL Labs Grade A. Annual third-party pen test scheduled before first enterprise customer in production.
We are an early-stage company; not every artifact below exists in finished form yet. Where it does not, we will say so. Where it does, you receive it under standard NDA within one business day.
Standard DPA template available; SCCs included for cross-border processing.
Request →One-page description of the production stack, network posture, and data flow. NDA-friendly.
Request →Honest letter describing where we are in the SOC 2 process and the projected timeline. Available now.
Request →Scope and selected vendor for the first external pen-test, to be commissioned before first production enterprise customer.
Request →If you found a security issue, please email the address below. Researchers acting in good faith will not be pursued. We will acknowledge receipt within one business day.