# The security review pack

> Atlantic's standard answers to a security questionnaire, each with the document that evidences it, in LightHouse and as a download.

The **security review pack** is Atlantic’s versioned, dated set of standard answers to security questionnaires, each naming the document that evidences it. It is at **Settings → Security review** in LightHouse™ and is available to every role.

## Coverage

|                                          |                             |
| ---------------------------------------- | --------------------------- |
| Governance                               | Access control              |
| Identity and multi-factor authentication | Encryption                  |
| Key management                           | Data location and residency |
| Tenant isolation                         | Logging and audit           |
| Vulnerability management                 | Secure development          |
| Incident response and support            | Vulnerability disclosure    |
| Business continuity and backups          | Sub-processors              |
| Personal data and the DPA                | Artificial intelligence     |
| Insurance                                | Certifications              |

The page also links the agreements in force, the [sub-processor list](/trust/subprocessors/) and the [security controls summary](/trust/security-controls/).

## Formats

| Format              | Content                                                                                                                   |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------- |
| **Download (CSV)**  | One answer per row, for transfer to a questionnaire. Cells that a spreadsheet would interpret as formulae are neutralised |
| **Download (JSON)** | The same answers in a machine-readable file                                                                               |
| API                 | `GET /api/v1/security-review?format=csv` or `?format=json`, for any role in the tenant                                    |

The answers are in English, the language of the agreements. The surrounding page follows the tenant’s language setting.

## Maintenance

| Control                | Detail                                                                                                                                                                                                                                                 |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Single source**      | The page, the CSV, the JSON and the API read the same answers                                                                                                                                                                                          |
| **Agreement versions** | Answers that name the MSA and DPA take the versions in force from LightHouse                                                                                                                                                                           |
| **Wording check**      | An answer set that claims a certification, offers a guarantee or states outright that the service meets a standard is refused before publication. Certification to ISO/IEC 27001 and ISO/IEC 42001 is under way, and the pack states it in those terms |
| **Evidence**           | Each answer names its supporting document, published on the company site or on this site, or available under NDA                                                                                                                                       |
| **Versioning**         | A change produces a new version. The version and date are shown on the page and in each download                                                                                                                                                       |

## Under NDA

The pack contains no detail that would weaken a control if published. Further detail, including the architecture, configuration defaults, evaluation results and security assessment summaries, is available to named people under a mutual NDA, with a security walk-through by our certified forward-deployed engineers. See [Verify it yourself](/security/verify/#what-we-will-show-under-nda).

Source: https://docs.atlanticagenticlabs.com/enterprise/security-review/