Legal
Trust center
Last updated October 12, 2026
This page sets out how we protect the data you trust us with, the controls available to your organization and where our compliance work stands. We only list what is true today and mark anything that is still in progress.
Compliance programme
| Programme | Status | Detail |
|---|---|---|
| UK GDPR and EU GDPR | In place | Processor terms in our data processing agreement, a published sub-processor list and UK data hosting. |
| Cyber Essentials Plus | In progress | Independent assessment against the UK government's baseline security controls. |
| ISO/IEC 27001 | Planned | A certified information security management system, run through a compliance automation platform. |
| SOC 2 Type II | Planned | An attestation report for customers who need one. |
Data protection
- Conversations, files and settings are stored in DigitalOcean's London data center. Atom runs on GPU servers we operate in DigitalOcean's Toronto data center in Canada.
- Data is encrypted in transit with TLS 1.2 or later, and at rest in our managed databases and object storage.
- We do not train Atom on business conversations and we never sell personal data.
- Workspace owners can set a retention period so conversations are deleted automatically, and anyone can export or permanently delete their conversations.
Identity and access
- Single sign-on with SAML 2.0 or OpenID Connect, with verified domains, enforced SSO and just-in-time account creation.
- SCIM 2.0 provisioning of users and groups, with groups mapped to workspace roles and instant deprovisioning.
- Two-factor authentication with an authenticator app, email codes or passkeys, and the ability to sign out every session.
- IP allowlists, and controls over which connectors and MCP apps people in your workspace can use.
Audit and compliance tools
- A tamper-evident audit log: every event is chained to the one before it with a SHA-256 hash.
- A compliance API for eDiscovery that exports conversations, file details and audit events, and checks the audit chain is intact.
- Usage analytics by person, model and feature in the admin console.
Infrastructure and engineering
- Services run in containers on managed Kubernetes with least-privilege access, and secrets are kept out of source code.
- Code that Atom runs, and the browser agent, execute in short-lived isolated sandboxes with no access to your account or other users.
- Every change goes through review and continuous integration with automated tests before it is deployed.
- Managed databases are backed up daily and backups are encrypted.
Sub-processors
Every sub-processor, what it does and where it runs is listed in our privacy policy. Business customers get at least 30 days' notice before we add a new one.
Documents
- Data processing agreement, including our technical and organizational security measures
- Privacy policy and terms of use
- security.txt for security researchers
- Security questionnaires and countersigned agreements: email security@incbury.co.uk
Vulnerability disclosure and bug bounty
We welcome reports from security researchers. Email security@incbury.co.uk with the steps to reproduce the issue and we will acknowledge it within two working days.
- In scope: incbury.co.uk, chat.incbury.co.uk, platform.incbury.co.uk, api.incbury.co.uk, the mobile apps, Incbury Code and the browser extension.
- Only use accounts you own, do not access or change other people's data, and stop as soon as you have shown the issue.
- No denial of service, spam, social engineering or physical attacks.
- Give us reasonable time to fix the issue before telling anyone else.
- If you follow these rules in good faith, we will not take legal action against you for your research.
We pay discretionary rewards for valid, previously unknown vulnerabilities, based on their impact. Model behaviour or prompt injection findings without a security impact are welcome but are not normally eligible.
Contact
Security and compliance questions: security@incbury.co.uk.