AtlasOA: Outcomes Assessment for Higher Education and Technical Colleges

AtlasOA is designed around five categories of defense, in order of impact:

• Data residency. Your assessment data lives on hardware your campus owns. Nothing is stored in a vendor cloud, no telemetry phones home, no third party can subpoena what we do not have.
• Access control. Three roles with six adjustable permissions. Any user with read permission can see all programs; per-program scoping is not available yet.
• Network isolation. AtlasOA makes no outbound connections unless you turn on an integration, email alerts, or offsite backup, and then only to the addresses you enter. Every connection is listed in the network reference.
• Audit logging. Every state-changing action is recorded to a separate, append-only audit database with hash-chain integrity verification.
• Code-level defense. Parameterized queries, CSRF protection on every state-changing endpoint, validated file uploads, salted password hashing.

Every release goes through three layers of review before it ships:

• Automated test suite. Hundreds of tests run on every commit, covering authentication, authorization, data integrity, audit logging, file handling, and the core assessment workflow. Releases are blocked if anything fails.
• Internal security audit. Before each release, the codebase is reviewed against the OWASP Top 10 and a custom checklist focused on assessment data: SQL injection, cross-site scripting, broken access control, insecure file handling, sensitive-data exposure, and authentication weaknesses.
• Adversarial code review. Each release is also reviewed by an in-house red-team pass that actively tries to break the controls: race conditions, IDOR enumeration, path traversal on file uploads, and CSRF and session handling.

Findings are tracked in a private security log and remediated before the release reaches founder partners. We treat every audit cycle as another chance to harden the platform.

We would rather build the controls than wave a sticker. Here is the honest list of what we have not done:

• No third-party penetration test yet. Internal adversarial review is rigorous, but it is not the same thing as a paid pen-test from an outside firm. When one is completed, its summary will be listed in the Trust Center.
• No SOC 2 Type 2 yet. SOC 2 is a process audit, not a security audit, and we are not large enough to justify the $40K to $80K annual cost yet. When founder revenue supports it, we will pursue it.
• No HIPAA or FERPA certification. AtlasOA is FERPA-aware (audit logging, access controls, data residency on your servers), but FERPA compliance is determined by how the institution operates the platform, not by a vendor cert. We will help your registrar map AtlasOA to your FERPA program.
• No "military-grade" anything. The phrase is marketing fluff. We use industry-standard controls.

Security & Architecture · Independent validation status · Review our Trust Center

Any vendor that tells you they have all of the above - regardless of company size - should be asked to produce the actual letter of attestation. Marketing pages are not evidence.