Trust Centre

Role-based access control (RBAC), multi-factor authentication (MFA), and least-privilege principles govern system access, consistent with our ISO 27001 Access Control policies.

Data is encrypted in transit using TLS 1.2+ (preferring TLS 1.3) and at rest using AES-256, consistent with our ISO 27001 cryptography policy (A.8.24).

Atrium is built under a documented secure development lifecycle, including secure coding standards, application security controls, threat modelling, and change management aligned to ISO 27001.

Systems are patched under defined SLAs based on severity, with updates tracked across servers, endpoints, and network equipment.

We perform penetration testing on our Atrium production systems using an independent, ISO 27001-certified security testing platform, run at the end of each monthly sprint when product changes are released. Findings are logged as issues in Jira and remediated on a priority basis.

Our systems are monitored using Microsoft Azure Sentinel and Microsoft Defender, with alerting and incident tracking managed through Jira Service Management, backed by a defined incident-response procedure for timely triage and response.

Our infrastructure is hosted across ISO 27001-certified providers, including Macquarie Technology (Sydney data centre), Oracle Cloud Infrastructure, Microsoft Azure, and AWS, whose facilities feature controlled physical access, surveillance, and environmental controls.

Staff and contractors complete ongoing security awareness training, reinforced by regular internal campaigns.

Our network is protected by Palo Alto next-generation firewalls with integrated intrusion prevention, securing connectivity between our offices and cloud environments (Macquarie Technology, Oracle), with Macquarie Technology providing a redundant managed firewall for our dedicated server infrastructure. Web-facing applications are further protected by Cloudflare's Web Application Firewall (WAF) and DDoS mitigation.

Customer data is backed up with automated recovery verification, confirming backups are complete and restorable. Backup integrity is monitored on an ongoing basis.

Our infrastructure is geo-distributed across multiple cloud providers, reducing the impact of any single localised outage.

Scheduled maintenance and defined patch-management SLAs keep infrastructure current and secure, with maintenance communicated to customers in advance.

You can export your data in standard formats; we support portability and will not hold your information hostage.

Customer data is stored in Australian data centres by default, with specific residency options available on request.

Defined retention schedules apply to all data categories. On contract termination, customer data is securely deleted within 30 days.

Read our full Privacy Policy, covering all aspects of personal data handling. Privacy Policy

Download our current certification. ISO 27001:2022 Certificate

Our ISO 27001 Statement of Applicability is available to qualified customers on request