Trust Center

What this page covers

• Security overview, privacy and compliance posture.
• Infrastructure, authentication, authorization and encryption.
• Backup procedures, disaster recovery and incident response.
• Responsible disclosure, vendor security and third-party providers.
• System status and release notes.

Security overview

Atlas is a private, authenticated business system. There is no public sign-up: accounts are created for named people by an administrator, and every record is reachable only through an authenticated session. Security controls are enforced in the database itself rather than in the interface alone.

Privacy overview

Information in Atlas is used only to operate the services it provides. We do not sell personal information and do not use it for third-party advertising. Full detail is in the Privacy Policy.

Compliance

MR Advisors Intl LLC does not claim any security certification or regulatory audit outcome for Atlas. What we do publish is the set of controls described on this page and the commitments in our legal documents. Our SMS program is prepared for A2P 10DLC registration and its terms are published in the SMS Terms & Conditions. If you need written answers to a security questionnaire, contact mahbu@mradvisorsintl.com.

Encryption

Traffic to Atlas is served over HTTPS/TLS. Stored data is encrypted at rest by our hosting and database provider. Provider credentials and API keys are held as server-side secrets and are never exposed to the browser.

Authentication

• Email and password sign-in with sessions managed by our authentication provider.
• Password reset by verified email link; passwords are never stored in Atlas records.
• Sessions persist per browser and can be ended by signing out.

Authorization

Access is role-based — Admin, Staff, Client, Tenant and Vendor. Roles are stored separately from user profiles and evaluated by a database function, so a user cannot change their own role. Row-level policies decide which rows each role can read or write, and administrative areas such as the Legal Center and Production Readiness require an administrator role. Sensitive actions are written to an append-only audit log recording the user, action, affected record and timestamp.

Backup procedures

Atlas records backup runs internally with their status, scope and timestamp, and stores exports in an access-controlled bucket readable only by administrators or the user who created the run. Our database provider also maintains its own managed backups.

Disaster recovery

Recovery is based on restoring the most recent verified database backup and redeploying the application, which holds no state of its own. Restore verification is tracked against each backup run so a restore is exercised rather than assumed.

Incident response

Suspected incidents are triaged by the Atlas administrator, contained by revoking the affected credentials or access, investigated using the audit log and provider logs, and followed by notification to the people affected where the law or the relationship requires it. Report a suspected incident to mahbu@mradvisorsintl.com.

Responsible disclosure

If you believe you have found a vulnerability, email mahbu@mradvisorsintl.com with the details and how to reproduce it. Please give us a reasonable period to respond before disclosing publicly, do not access or modify data belonging to other people, and do not run denial-of-service or automated scanning against the service. We will acknowledge your report and keep you informed while we investigate. We do not currently operate a paid bounty programme.

Infrastructure

Atlas runs as a managed web application on the Lovable platform with a managed PostgreSQL database, object storage and authentication. The application layer is stateless — all durable state lives in the database and storage buckets.

Vendor security

• Contractors and vendors reach Atlas only through a named account with the Vendor role, which is limited by row-level database policies to the work assigned to them.
• Vendor records hold licence, insurance and W-9 status so compliance can be checked before work is assigned.
• Vendor access is removed when an engagement ends; the historical record and audit trail are retained.
• Vendors are asked to report any suspected exposure of Atlas data to us immediately.

Third-party providers

Atlas relies on a small number of vetted providers. Each is selected on the basis of its published security practices, is given only the access its function requires, processes information solely on our instructions, and is reviewed when its role or our use of it changes.

• Application hosting and deployment platform.
• Managed PostgreSQL database, authentication and object storage.
• Email delivery provider for notices and receipts.
• Messaging provider for SMS/MMS — configured but not enabled.

Providers process information only on our instructions and only to deliver the service described above.

System status and release notes

Current availability is published on the System Status page, and material platform changes are listed in the Release Notes.

Shared responsibility

• Our platform providers are responsible for physical security, host patching and the managed database, storage and authentication services.
• MR Advisors Intl LLC is responsible for how Atlas is configured: roles, access policies, retention, backups, communications and the accuracy of this page.
• Users are responsible for keeping their credentials confidential, using their own account, and reporting anything suspicious to us.

Questions about anything on this page: MR Advisors Intl LLC, Bronx, New York, United States · info@mradvisorsintl.com.