When you put AtomicX on your website, your visitors trust you with their questions, their contact details and sometimes more. You, in turn, trust us with that data and with your own content: your knowledge bases, documents and workflows. This page explains how we protect it.
For your visitors' data, you are the controller and Atomic Motion Ltd. is the processor. Our data processing agreement sets out those roles in detail.
What data we handle
- Conversations: the messages exchanged in your chat widget, and any contact details or answers a visitor chooses to share.
- Your content: the knowledge bases, documents, website pages and agent instructions you give AtomicX so it can answer.
- Account data: your team members, settings and billing details.
Data residency
EU data stays in Frankfurt. North-American data stays in Toronto. Enterprise plans can pin residency to either region.
Data centers and servers
AtomicX runs in Microsoft data centers, and we rely on Microsoft's security practices for physical access. Many of the world's largest banks, healthcare providers and government bodies host their data the same way.
Patching and anti-malware: We patch all servers monthly and run industry-recognized endpoint protection on every one.
Monitoring: We monitor all the production systems that power the AtomicX platform, so we can see problems as they happen.
Network security
We separate our network into zones with their own controls. For example, the public zone is kept apart from the backend zone. All inbound traffic to the AtomicX platform passes through an application gateway acting as a web application firewall, in line with Microsoft's recommended network design.
Network monitoring: We use intrusion detection and prevention systems (IDS and IPS) to spot unusual inbound and outbound traffic and stop security events.
Security event monitoring (SIEM): Security logs from our systems are collected in one SIEM solution, so our security team can monitor, detect and respond to incidents from one place.
Application security and encryption
Penetration testing: An independent third party tests our web applications and network once a year.
Vulnerability scanning: Every code release is scanned automatically before it reaches our testing environment. If the scan fails, the release goes back to development.
Encryption in transit: Communication over the internet and inside our network is encrypted with HTTPS, SFTP and TLS.
Encryption at rest: All data stored on disk is encrypted with AES-256.
Separate environments: Development, testing and staging are separated from production, both physically and logically.
Access control
A security plan is only as strong as its weakest link, so we limit who can reach your data.
Role-based access and least privilege: Our staff get permissions through defined roles, and only the permissions their job needs.
Access logging and audit: Access is logged and monitored continuously, so we can check our policies are being followed.
Roles in your own account: You decide who on your team can see conversations and change settings, by giving each team member the role they need.
How we use your data
No AI training on your data: Atomic Motion Ltd. does not use client data, including your conversations and your content, to train AI models.
Your content stays yours: Your agents answer from the knowledge bases and documents you provide. Another customer's agent never sees them.
Visitor requests: Visitors can ask for their personal data to be removed through our GDPR removal request form.
Security operations
Incident response: We have a documented incident response plan that covers every stage, from detection to post-incident review. It follows ISO 27001 guidelines, and our ISO 27001 certification is in progress.
Disaster recovery and backups: We have policies, tools and procedures to keep disruption to a minimum if something goes wrong. Customer data is replicated to a secondary site that takes over if the primary site goes offline, and we test the disaster recovery plan every year.
Questions
Need our sub-processor list, a signed DPA or answers for your security review? Email hello@atomicx.eu and we'll help. This page gives an overview of our security practices, and it will change as those practices improve.
Last updated 15 October 2026