Vet us the way you'd vet any vendor.
You're expected to make reasonable efforts to protect client information, and that includes the software you trust with it. This page gives you what you need to make that call: what's in place today, what's still in progress, and where our product stops.
Last updated September 27, 2026Posture at a glance
- Each firm's records are isolated at the database levelIn place
- Encryption in transit and at restIn place
- Daily scan of access rules, dependencies, and configurationIn place
- SOC 2 Type IINot yet
- Multi-factor authentication and role-based accessScheduled
Reviewer packet and subprocessor list: security@trustlenshq.com
What's in place today
Each firm's records are walled off at the database level.
Row-level security applies to every assessment and account record. One firm can't reach another firm's data, even with a compromised login token.
Review the hosting details before sharing client data.
The app runs on Base44. Before sharing confidential matter information, ask for current hosting, subprocessor, and encryption details for your firm's review.
The free assessment never touches an AI model.
Your answers are scored by fixed rules and stay on our platform.
We don't train AI models on your data.
Neither do our providers. Our agreement with our AI provider rules it out, and our customer contract says so in writing.
A person reviews AI output before you see it.
When Atlas uses AI to flag a possible issue in a document, someone on our team checks it before it appears as a finding.
We scan the platform every day.
It covers access rules, dependencies, and configuration.
What's still in progress
We're an early company. Here's what isn't finished, so you don't have to find out later.
SOC 2 Type II
We're not certified yet. Our observation period is planned to begin during our December 2026 beta, and the audit covers at least six months of operation. We'll post dates here as they're set.
Multi-factor authentication and role-based access
Both are Atlas product requirements. A confirmed delivery date has not been published.
Where Atlas stops
Atlas helps you see risk and act on it. It flags issues, and organizes who owns each one, what's due, and what evidence exists. It doesn't tell you whether you comply with a rule. That judgment belongs to you and your counsel.
Your data, your call
You can request deletion of your firm's account and assessment data. A fixed deletion timetable has not been published; confirm the current retention terms before sharing confidential client records.
For your carrier, IT provider, or security reviewer
Email security@trustlenshq.com. We'll answer your security questionnaire and send our subprocessor list and data processing terms.
Found a vulnerability? Tell us at the same address. Please avoid including client or matter information; a guaranteed acknowledgement timeframe has not been published.
Rule-scored, no AI, about 10 minutes.