TokenAtlas is AI financial infrastructure — teams route real budget decisions through it. This page documents exactly how we protect that trust: what we encrypt, what we isolate, what we never collect, and how we respond when something goes wrong.
Email + OAuth via a managed identity provider with rotating refresh tokens, email verification and session revocation.
TLS 1.2+ in transit with HSTS. AES-256 at rest for databases, storage and backups.
We never ingest, log or store your raw LLM prompts or completions — TokenAtlas only sees pricing and token metadata.
Row-level security policies on every customer table, enforced at the database — not just the app layer.
TokenAtlas is a modern SaaS built on a hardened, edge-served stack. We follow defense-in-depth: multiple independent controls at the network, application and data layers so that a single failure does not expose customer data.
The application runs on globally distributed edge infrastructure. Databases and object storage are provisioned in hardened, SOC 2-aligned regions operated by our cloud providers (Cloudflare and Supabase/AWS). Environments are strictly separated: production data never flows into staging or development.
All customer records — including account profiles, saved calculations, workspaces and audit logs — are encrypted at rest using AES-256. Encryption keys are managed by our infrastructure provider's KMS, rotated on a regular schedule, and are never exposed to application code. Automated backups inherit the same encryption and are stored in a separate access domain from production.
Every request between your browser, our API and internal services is served over TLS 1.2+ using modern cipher suites. HSTS is enforced site-wide, mixed content is blocked, and we redirect all plain-HTTP traffic to HTTPS. Internal service-to-service traffic is authenticated and encrypted.
Sign-in is handled by a managed identity provider with battle-tested primitives. Sessions use short-lived access tokens plus rotating refresh tokens, email addresses are verified before privileged actions, and OAuth is available for password-less access via major providers.
Application-level roles (owner, admin, member) gate what a user can do inside a workspace. At the data layer, every user-facing table enforces row-level security policies bound to the authenticated user or workspace — meaning even a bug in application code cannot return another tenant's rows. Privileged server functions additionally require an explicit role check before elevated operations run.
TokenAtlas is a cost intelligence platform, not an LLM proxy. We operate on pricing metadata, token counts and calculator inputs — we never ingest, log or persist raw prompts or model completions. When you connect a provider API key, it is stored encrypted, used only to fetch usage/billing metadata, and never shared with any third party.
We collect only what is necessary to operate the product: account identifiers, workspace membership, saved calculations, usage metadata and standard request logs. We do not sell user data, do not use it to train third-party AI models, and do not enrich it with data brokers.
Operational data is retained only as long as it is needed to deliver the service. Application logs are retained for 30 days. Backups are retained for 30 days on a rolling window and then permanently deleted. When you delete your account, associated personal data is removed from primary systems within 30 days and expires from backups within the backup retention window.
TokenAtlas is built to be GDPR-aligned. We have a lawful basis for every processing activity, practise data minimisation, and honour data-subject rights (access, rectification, erasure, portability, objection) within 30 days of a verified request.
We give customers the primitives to run TokenAtlas safely inside their organisation and recommend the following operational hygiene.
The AI features inside TokenAtlas — spend insights, model recommendations, cost narratives — operate on aggregated, non-sensitive metadata. Outputs are advisory and always clearly labeled as AI-generated. We do not use customer data to fine-tune or evaluate third-party models, and we do not use AI to make automated decisions that would produce legal or similarly significant effects on end users.
Third-party integrations (Stripe/Paddle for billing, Supabase for data, Cloudflare for the edge) are scoped to the minimum permissions needed. Webhooks verify signatures using HMAC and constant-time comparison before any state change. Outbound calls to LLM provider billing APIs are read-only.
Every authenticated endpoint validates its input with a schema, verifies the caller's session on every request, and enforces the same row-level security policies as the UI. Rate limiting protects against abuse. Public endpoints (webhooks, health checks) verify signatures or use narrow read-only policies — never blanket access.
We monitor production continuously for anomalies. If an incident affects customer data, we notify affected customers without undue delay and, where required, within 72 hours of becoming aware, in line with GDPR Article 33. Post-incident, we publish a root-cause summary and the corrective actions taken.
TokenAtlas does not yet hold formal third-party certifications, and we won't claim ones we don't have. Our roadmap prioritises the controls customers ask for most.
Found something? Email security@tokenatlas.co. We acknowledge reports within 2 business days and coordinate disclosure with the reporter.
Data subject requests and DPA signatures: privacy@tokenatlas.co. See our Privacy Policy for the full processing details.
A note on compliance: TokenAtlas is built on security and privacy best practices, and we're pursuing formal attestations on the roadmap above — but we don't currently hold SOC 2, ISO 27001 or similar third-party certifications, and we won't claim ones we don't have. If your procurement team needs a security review, please contact us and we'll respond with the artefacts we do have.
TokenAtlas