Skip to content
Log inTry it on your repoBook a live run
Book a live run
MenuClose

Atlantic works inside a boundary you set.

Atlantic can change only repositories in both your GitHub App install and your own selection. Atlantic never pushes to your default branch. Auto-merge stays off unless you turn it on for repositories you name.
Book a live run
Try it on your repo

You choose the repositories, Atlantic stays inside them.

Atlantic writes only to GitHub. A run can include up to 5 repositories.
  • 01

    Repository scope

    A repository is in scope only when it is in both your GitHub App install and your own selection.

    You choose the set
  • 02

    Pull requests only

    Atlantic opens pull requests. Atlantic never pushes to your default branch. Auto-merge stays off unless you turn it on for repositories you name.

    Auto-merge is off by default
  • 03

    Sealed secrets

    Secrets are encrypted per organization with AES-256-GCM, injected when a preview boots and never written to your repository. Secret-shaped literals are blocked.

    Never in your repository
  • 04

    Previews do not linger

    Previews stop after 6 hours idle. Previews expire within 7 days. Previews are destroyed when the pull request closes.

    Gone within 7 days

Compliance

  • Live, not mocked

    Each provider is marked live or mocked, and a production run refuses mocks.

  • Call ledger

    Every external call a run makes is logged with source, status and time.

  • Guardrail on every diff

    Every diff is checked against a 2,500 changed-line budget by default. The diff guardrail rejects binary changes. The diff guardrail includes a repository-mismatch check.

  • No model training

    Amazon Bedrock does not train on prompts or completions. Atlantic does not train or fine-tune models.

A run can include up to 5 repositories.

Repository cards on the repositories page of the Atlantic app in an example workspace, among them api and web-app.
Example workspaceThe repositories page: example repositories, each with its language and its branch.

Where your code goes.

Five questions security teams ask first, answered plainly.
  1. 01

    Where is my code processed?

    Atlantic's workers and evidence storage run on AWS in us-east-1.

    • Each organization gets its own preview worker, and a worker is never shared. Processing uses rootless Docker.
    • Tests run with networking off.
    • Model calls go through Amazon Bedrock, which can use AWS cross-region inference, so a request may be served in another AWS region. Atlantic does not claim EU-only or US-only processing.
  2. 02

    Which models see it?

    Atlantic uses Anthropic Claude and OpenAI GPT models through Amazon Bedrock.

    • 03

      Is it used for training?

      No. Amazon Bedrock does not train on prompts or completions.

      • Atlantic does not train or fine-tune models.
    • 04

      Is it stored, and for how long?

      Previews are short-lived. QA recordings are kept for 180 days.

      • Previews stop after 6 hours idle. Previews expire within 7 days. Previews are destroyed when the pull request closes.
      • QA recordings are stored in Amazon S3 and deleted after 180 days.
      • Secrets are encrypted per organization with AES-256-GCM, injected when a preview boots, and never written to your repository.
    • 05

      Who can access it?

      Only repositories you install and select.

      • Atlantic can change only repositories in both your GitHub App install and your own selection.
      • Atlantic opens pull requests. Atlantic never pushes to your default branch. Auto-merge stays off unless you turn it on for repositories you name.

    Read AWS's Amazon Bedrock data protection policy (opens in a new tab), our sub-processors, and our DPA.

    What we are explicit about.

    Plain statements about how Atlantic works.

    • Secret-shaped values are blocked

      Secret-shaped literals are blocked. Secrets are injected when a preview boots.

      Never in your repository

    • Merging stays yours

      Atlantic never pushes to your default branch. Auto-merge stays off unless you turn it on for repositories you name.

      Auto-merge is off by default

    • SOC 2 Type II attestation

      Atlantic AI Inc. holds a SOC 2 Type II attestation. Atlantic AI Inc. is GDPR compliant at the company level.

      Company-level compliance

    Bring one ticket.

    Book a live run
    Try it on your repo