Security and data handling

Atomic Reps requests the minimum Slack OAuth scopes needed to deliver daily reps and answer the /reps commands:

• commands - register the /reps slash-command entry point.
• chat:write, chat:write.public - post the daily rep into the configured channel, including channels the bot has not joined.
• channels:read, groups:read - list channels so you can choose where reps are posted.
• users:read, users:read.email - map Slack users to workspace members so each answer counts toward the right person's own record.
• im:write - send direct messages: daily practice questions in workspaces set to DM delivery and apprentice companion updates. Any member can mute DMs at any time with /reps mute.

We do not request any message-history scope (channels:history, im:history, or similar). We do not read message content from your channels or DMs. The only inputs we process are the answers submitted through our interactive components.

Slack words the consent screen differently from this list. Every sentence it shows you, paired with the scope behind it, is on the Slack page.

The data path:

1. A team member answers a daily rep in Slack.
2. Slack posts the answer event to our Convex HTTP endpoint over TLS 1.3.
3. Convex verifies the request signature, then writes the response (anonymized in the aggregate path for the free tier; attributed to the member on Team) and updates the team rollup.
4. No dashboard reads that rollup back out. An engineer's own practice record is visible to that engineer alone, and it stays theirs. When the workspace's retention window rolls or the subscription ends, the workspace loses its link to the answers while the engineer keeps the record.

No code from your repositories is ever sent to Atomic Reps. Messages outside the rep flow are never read.

Each engineer's own practice record is permanent, visible only to them, and managed from their account page. The retention windows below govern the workspace's link to it, never the record itself. Free tier: anonymous team aggregates on a 90-day rolling window, with no admin-facing view of them; they exist to tune question difficulty. The workspace's link to the underlying participation records (Slack user ID, per-question correctness) is removed after 90 days, and those records are never shown to admins at any point. Team plan: workspace attribution runs on a 365-day rolling window while the subscription is active. When the subscription ends, the workspace's per-member layer is removed immediately and cannot be restored, even if you resubscribe. The practice targeting set up for each member is deleted, and every member's answers are permanently unlinked from the workspace, while each member keeps their own record. Anonymous aggregates continue under the 90-day window. Separately, if you uninstall the Slack app, the disconnected integration and its data are deleted within 15 days (a 14-day retention window plus a daily deletion sweep). Billing and tax records are kept for 7 years as required by Swedish and equivalent foreign law. See the Privacy Policy for the full per-category schedule.

TLS 1.3 in transit. At rest, Convex's infrastructure encrypts data with AES-256, and backups inherit the same encryption. Authentication tokens, including Slack bot tokens, are stored encrypted; secret material never leaves the server.

We publish current service health at status.atomicreps.com. That page runs on separate infrastructure from the product, so it keeps answering during an outage of the product itself. It reports three things: whether the site is reachable, whether the backend deployment is executing scheduled work, and whether daily-question delivery is running.

Behind it, a health sweep runs every half hour. A critical condition pages us immediately by Slack and email. We batch the rest into a daily digest. Delivery failures also alert you directly: after two consecutive failed posts, whoever installed the app in your workspace gets a Slack DM and an email naming the error, repeated at most once a day while the failure persists.

We publish no uptime SLA. This is a self-serve product run by a small team, and a number we cannot back with a credit is not worth printing. What we can commit to is that incidents show on the status page rather than being absorbed quietly.

• Cloudflare - hosting, CDN, and cookieless aggregate traffic measurement.
• Convex - application database and functions.
• Clerk - authentication.
• Slack - rep delivery.
• Polar - payments (Merchant of Record; uses Stripe for card handling).
• Resend - transactional and marketing email.
• PostHog - product analytics, plus session replay on our public marketing pages only (text input masked). Loaded only after consent.

The current list, each subprocessor's location, and the transfer mechanism we rely on (EU-US Data Privacy Framework or EU Standard Contractual Clauses) are maintained in the Privacy Policy and the DPA. We give 30 days' notice before adding a subprocessor.

Atomic Reps does not ingest, read, or store source code from your repositories. The product surface is multiple-choice questions, short free-text reflections on those questions, and the Slack messages that carry them - nothing more.

Every question lives in a versioned corpus we maintain in-house. Each one carries its explanation. Version-sensitive questions also carry a verification date, and we re-check them against current official documentation on a schedule. New and revised questions pass automated quality gates (correctness review and style lints) before they can ship.

When a question is wrong anyway, email support@atomicreps.com. The corpus is global, so a confirmed error is corrected or pulled from rotation for every workspace at once - not silently left in the pool.

We never use your data to train, fine-tune, or improve AI or machine-learning models, and we never sell or share it. We do not send customer data (employee names, email addresses, or responses) to third-party AI providers.

Every member exports their own data without asking us. From their account page they can download the whole record as one machine-readable file (every answer, course progress, certificates, streaks and the apprentice, across every workspace they belong to), reset parts of it, or delete the account outright. We build the file and email a link that works for 24 hours, one export a day. That is the GDPR Art 15 and Art 20 path, and it does not go through a ticket queue.

Workspace admins can delete a workspace, including all per-member responses and rollups, from the billing settings. A full export of the workspace's history, or an erasure request made on someone else's behalf, is still a manual request to privacy@atomicreps.com. We aim to complete workspace exports within five business days. Data-subject rights requests are handled without undue delay and within the deadlines required by applicable data-protection law.

If a refund is also in play: a refund cancels the subscription immediately and permanently removes the workspace's per-member layer, and that cannot be undone. The 14-day refund window runs from the charge and is not extended by an export request, but the two are independent - request the export while the workspace history is still available and we complete it even if the refund is processed first.

Send it to security@atomicreps.com, with steps to reproduce and a way to reach you. The same address is published in /.well-known/security.txt under RFC 9116. We publish no PGP key. If a report needs encryption, send a first mail with no details and we will arrange a channel.

What we do with it. We aim to confirm receipt within two business days and, within ten business days, to tell you whether we reproduced it, how we rate it, and when we expect a fix to ship. If a report turns out to be a duplicate or out of scope we say so plainly rather than going quiet.

In scope. The Atomic Reps web app and marketing site on atomicreps.com and its subdomains, the Atomic Reps Slack app, and our backend API. Test against a free workspace you create yourself.

Out of scope. Findings in a subprocessor's own infrastructure (report those to the subprocessor; the list is above). Volumetric or denial-of-service testing. Social engineering of anyone, including us. Physical access. Raw scanner output with no demonstrated impact, and missing hardening headers with no exploit path.

What we ask. Do not access, modify, or keep data that is not yours, do not degrade the service for anyone else, and do not test against another customer's workspace. If you reach real personal data by accident, stop, tell us, and delete your copy.

What we commit to. If you follow the rules above and report in good faith, we will not pursue or support legal action against you over the research, and we will treat it as authorized rather than as unauthorized access. We ask for 90 days before you publish, or less if we ship the fix sooner; we will not ask you to stay quiet indefinitely. We run no paid bounty: we have no budget for one and would rather say so than imply otherwise. We will credit you by whatever name or handle you choose, or leave you out of it entirely, as you prefer.

Atomic Reps is a self-serve product. It is not SOC 2 certified; this page documents the security controls that matter. A Data Processing Agreement is published at /dpa and is incorporated automatically on every plan from the moment you install, Free included, with the EU Standard Contractual Clauses for transfers outside the EEA. For a counter-signed DPA, a security questionnaire, or other procurement needs, email legal@atomicreps.com.