Security Policy

1.Governance and compliance

ATALI ELECTRIC holds a SOC 2 Type II report, issued after an independent examination of our controls, and renews it each year. Customers can request the report under a confidentiality agreement at security@atalielectric.com. Our Head of Security and Compliance owns the security program, policies are reviewed at least annually, and every employee completes security training at hire and once a year.

2.Encryption and key management

Customer data is encrypted with AES-256 at rest, in databases, object storage and backups, and with TLS 1.3 in transit, between customers and the platform and between internal services. Encryption keys are held in AWS Key Management Service and rotated annually, and application secrets are kept in a managed vault, never in source code.

3.Tenant isolation and data residency

Each customer's rent rolls, operating statements and evidence packets are isolated from every other customer's, with access checks enforced in the application and at the data layer. Automated tests run on every release to confirm that one tenant cannot read another's records.

US customer data is hosted on Amazon Web Services in us-east-2 (Ohio), with failover to us-west-2 (Oregon). Customer content is not stored outside those US regions.

4.Access control

Multi-factor authentication is required for every employee and available to every customer user, and customer administrators can require it for all users. Role-based access control separates owners, consultants, analysts and view-only users, and Enterprise customers can sign in through SAML 2.0 single sign-on, including with Okta.

Staff access to production is limited to what each role needs, approved in advance, time-limited and logged. Engineers and support staff in Faridabad use the same controls from managed devices, and access is reviewed every quarter.

5.Application security

Every change is peer-reviewed before release. Our pipeline runs static analysis, dependency scanning and secret detection, and an independent firm performs a penetration test at least once a year. We track every finding to closure and fix critical vulnerabilities within 7 days and high-severity vulnerabilities within 30 days.

6.Infrastructure and monitoring

Production runs in private network segments on AWS, with Cloudflare providing a web application firewall and denial-of-service protection at the edge. Systems write to centralized logs, audit logs are kept for 13 months, and alerts route to a 24-hour on-call rotation.

7.No AI training on customer data

We do not use customer property financials, valuation workbooks, leases or notices to train or fine-tune any AI or machine learning model. Document extraction and valuation models are built from public records, licensed market data and synthetic documents. Customer documents are processed inside our AWS environment to deliver the service to that customer and for no other purpose.

8.Backups and continuity

Encrypted backups are taken daily and replicated to a second US region. We test restores every quarter and exercise regional failover every year against a documented continuity plan.

9.Incident response

A documented plan covers detection, classification, containment, recovery and review, and on-call engineers can start it at any hour. We notify affected customers without undue delay, and within 72 hours, after confirming a breach that affects customer data, and we complete a written post-incident review that identifies corrective actions.

10.Vendors and subprocessors

We assess each vendor's security before engaging it, bind it to written confidentiality and security terms, and review it every year. The vendors that process customer or personal data are listed at /subprocessors.

11.Retention and deletion

Customers can export their data at any time. After termination, we keep it available for export for 30 days, delete it from production systems within 30 days afterward and from encrypted backups within 90 days of termination.

12.Reporting a vulnerability

Send reports to security@atalielectric.com with enough detail to reproduce the issue. We acknowledge reports within two business days and will not take legal action against good-faith research that avoids accessing other people's data, degrading the service or social engineering our staff. Please give us reasonable time to fix an issue before disclosing it.

13.Customer responsibilities

Security is shared. Customers are responsible for:

• managing their users, removing access when people leave, and enabling multi-factor authentication or single sign-on;
• choosing what they upload and confirming they have the right to upload it; and
• verifying every evidence packet before it is filed with a county board.