The security review pack
The security review pack is Atlantic’s versioned, dated set of standard answers to security questionnaires, each naming the document that evidences it. It is at Settings → Security review in LightHouse™ and is available to every role.
Coverage
Section titled “Coverage”| Governance | Access control |
| Identity and multi-factor authentication | Encryption |
| Key management | Data location and residency |
| Tenant isolation | Logging and audit |
| Vulnerability management | Secure development |
| Incident response and support | Vulnerability disclosure |
| Business continuity and backups | Sub-processors |
| Personal data and the DPA | Artificial intelligence |
| Insurance | Certifications |
The page also links the agreements in force, the sub-processor list and the security controls summary.
Formats
Section titled “Formats”| Format | Content |
|---|---|
| Download (CSV) | One answer per row, for transfer to a questionnaire. Cells that a spreadsheet would interpret as formulae are neutralised |
| Download (JSON) | The same answers in a machine-readable file |
| API | GET /api/v1/security-review?format=csv or ?format=json, for any role in the tenant |
The answers are in English, the language of the agreements. The surrounding page follows the tenant’s language setting.
Maintenance
Section titled “Maintenance”| Control | Detail |
|---|---|
| Single source | The page, the CSV, the JSON and the API read the same answers |
| Agreement versions | Answers that name the MSA and DPA take the versions in force from LightHouse |
| Wording check | An answer set that claims a certification, offers a guarantee or states outright that the service meets a standard is refused before publication. Certification to ISO/IEC 27001 and ISO/IEC 42001 is under way, and the pack states it in those terms |
| Evidence | Each answer names its supporting document, published on the company site or on this site, or available under NDA |
| Versioning | A change produces a new version. The version and date are shown on the page and in each download |
Under NDA
Section titled “Under NDA”The pack contains no detail that would weaken a control if published. Further detail, including the architecture, configuration defaults, evaluation results and security assessment summaries, is available to named people under a mutual NDA, with a security walk-through by our certified forward-deployed engineers. See Verify it yourself.