Trust Center
See exactly how it works. Then test it yourself.
Everything an IT department, privacy officer, procurement office, or assessment team needs to evaluate AtlasOA and Atlas K-12 without a sales-controlled demo: where your data lives, what we can and cannot access, what security validation exists today, and what is still on the roadmap.
Last reviewed: September 2026
Five things that are true about both products
- Test it yourself for 30 days.Install the real software on a machine you control and evaluate it with your own people. How it works
- Your data stays on infrastructure you control.AtlasOA and Atlas K-12 run on your server. We do not operate a central database of your records. Architecture
- Your institution owns its data.We claim no ownership of institutional or student information. Data ownership
- Export your data when you need it.Standard formats and a standard database file, no proprietary lock-in. Exports
- We tell you what we have and what we do not.Current capabilities, known limitations, and the roadmap are published. Limitations and roadmap
At a glance
Short answers to the questions procurement and security reviewers ask first. Each links to the detail.
| Question | Answer |
|---|---|
| Where does the software run? | On Windows hardware your institution controls: a server, a virtual machine, or a PC. AtlasOA, LLC does not host it. Architecture |
| Does AtlasOA, LLC receive our student or institutional data? | Not during normal operation. Neither application has telemetry, crash reporting, or a connection to a vendor server, and neither contacts us for licensing. Outside services |
| Does any AI service receive student data? | No. AtlasOA contains no AI model calls. Atlas K-12's Compass assistant runs a local model on your server and does not call OpenAI, Anthropic, Google, or any other AI API. Compass AI |
| Can we get our data out? | Yes. In-app exports in standard formats, and the database itself is a standard SQLite file on your server. Data ownership and portability |
| Third-party penetration test? | Not yet No independent penetration test has been completed. We are enrolled in Anthropic's Cyber Verification Program, and AI-assisted security testing of both products is under way. Independent validation |
| SOC 2, ISO 27001, or similar attestation? | No Neither product has a formal attestation today. Independent validation |
| FERPA or COPPA certified? | No such certification exists for software. We explain how the architecture and controls support your FERPA and COPPA responsibilities. Privacy |
| Accessibility conformance report (VPAT)? | Not yet The applications have not been evaluated against WCAG. Accessibility |
| Is pricing public? | Yes. Flat annual tiers per institution or district. No per-student fees. Pricing |
| Who is responsible for what? | We are responsible for the application; you are responsible for the infrastructure it runs on. Shared responsibility |
Evaluate
30-Day Self-Directed Evaluation
How to request the evaluation package, install it on your infrastructure, and test it with your own team.
Test it yourself
Evaluation Playbook
What to test in 30 days: installation, roles, permissions, imports, reporting, exports, audit logging, backup, and security.
See the playbook
Sample Data and Templates
Synthetic datasets and import templates, so you never need production student records to find out whether the software works.
Download sample data
Architecture and data
Self-Hosted Architecture
Where the application, database, and files live, what connects outward, and what AtlasOA, LLC controls.
View the diagram
Data Ownership and Portability
You own your data. Export formats, what happens when a relationship ends, and what we can and cannot access.
Read more
Shared Responsibility
A plain matrix of what AtlasOA, LLC is responsible for and what your institution is responsible for.
See the matrix
Compass AI Privacy and Architecture
Where the model runs, what it can see, how permissions constrain it, and what is stored.
Read more
Integrations and Read-Only Access
Every integration with its method, direction, required permissions, and honest status.
See the matrix
Subprocessors and Outside Services
Which outside services touch what, and which never see application data.
Read more
Security and privacy
Security Controls and Development Practices
Authentication, authorization, audit logging, web protections, encryption, and how we build and test.
Read more
Independent Security Validation
What has been independently tested today, and what has not, stated plainly.
See current status
Privacy, FERPA, and COPPA
How the products support higher-education FERPA duties and K-12 student privacy, including sensitive MTSS data.
Read more
Vulnerability Reporting and Incident Response
How to report a suspected vulnerability and how we handle security issues and notifications.
Report an issue
Backup and Disaster Recovery
Built-in backup features, recommended strategy, and what remains your responsibility.
Read more
Updates and Patching
How releases are delivered, how you apply them, and where release notes live.
Read more
Technical requirements
System Requirements
Operating system, hardware, browser, and Compass AI hardware tiers.
See requirements
Network Requirements
Inbound ports, every optional outbound connection, and what each one is for.
See the reference
Accessibility
Current accessibility status of the applications and this website, and how to contact us.
Read the statement
Procurement and the relationship
Procurement Center
Company information, pricing, legal documents, the Data Processing Agreement, and what is available on request.
Open the center
Support, Implementation, and Documentation
What support includes, who does what during deployment, and where documentation lives.
Read more
Business Continuity
What your institution keeps if AtlasOA, LLC ever goes away.
Read more
Roadmap and Known Limitations
What is available now, what is in development, and what the products do not do today.
Read more
Release Notes and Changelog
Every shipped release with its date and what changed, including security fixes.
Open the changelog
Resources and Downloads
Brochures, IT director packets, system requirements, and shared-responsibility PDFs. Some PDFs predate September 2026; where they differ from the Trust Center, the Trust Center is current.
Open the library
How to read this Trust Center
We separate six kinds of evidence, because institutions should weigh them differently: vendor statements, architecture, implemented controls, internal testing, independent third-party testing, and formal attestations. Today, AtlasOA and Atlas K-12 have the first four. They do not yet have the last two, and every page says so where it matters.
AtlasOA and Atlas K-12 are two separate products from the same company, AtlasOA, LLC. Where a statement applies to only one of them, the page says which.
Do not take our word for it. Test it yourself. Install AtlasOA or Atlas K-12 on a machine your institution controls, use sample or non-production data, and let your own people decide.