Security

Atlas Macro is a small, founder-led education project. We hold very little personal data, and we try to protect it well. This page describes what we actually do. We do not hold security certifications such as SOC 2 or ISO 27001.

What we hold

• Your email address, and your first name and "where are you now" answer if you give them
• For some earlier subscribers, the company name they gave when signing up
• Whether you confirmed your subscription, and when. Sign-ups never confirmed are deleted after 30 days.
• If you accept analytics cookies, anonymous usage events (never your email address)

We do not take payments or hold any payment details. The full picture, including your rights, is in our Privacy Policy.

How we protect it

• Encryption in transit: the site and all our services are served over HTTPS only.
• Encryption at rest: subscriber data is stored with Neon (Postgres), which encrypts data at rest.
• Limited access: only the founder can reach subscriber data. The admin area needs a sign-in link sent to the founder's own email, and secrets are kept in environment variables, never in code.
• Sign-up protection: Cloudflare Turnstile and rate limiting help keep bots and abuse out of the subscribe form.
• Unsubscribe links are signed, so nobody can unsubscribe you by guessing a link.
• Browser protections: a Content Security Policy and standard security headers on every page.
• Separate test data: test and preview versions of the site use a separate database with no subscriber data.
• Error monitoring: Sentry alerts us to application errors. Error reports leave out IP addresses and cookies.

Service providers

We use established providers rather than running our own servers:

• Vercel: website hosting
• Neon: subscriber database
• Resend: email delivery
• Sanity: content management (no subscriber data)
• PostHog (EU): analytics, only after you consent
• Sentry: error monitoring
• Cloudflare: Turnstile bot check on the sign-up form
• Redis Cloud: short-lived rate-limit counters (no subscriber data)
• Amazon Web Services: our macro data service (no subscriber data)

Report a security issue