ATLASby Gradeum
Get started

Security and data

Where your files go, and what is logged

Where an answer is in quotation marks, it is the Terms of Service or the Privacy Policy, word for word, with the section it is in.

Atlas Cloud and Atlas Local

How your data moves

Atlas Cloud The hosted line

Each line is a connection Atlas Cloud makes, and what protects it.

Data flow, drawn as fortresses joined in a chain. The first is your Microsoft tenant: your team, and your Microsoft Entra ID at its gate. Everything goes through your Entra ID: from it, one line runs into the second, Gradeum’s Microsoft cloud, and splits three ways: the sign-in and HTTPS to Gradeum Keystone, mail through Exchange Online Protection to the ATLAS mailbox, and the way to your Atlas folder. Inside it are Microsoft 365 (the ATLAS mailbox and your Atlas folder) and Microsoft Azure (Gradeum Keystone, the hub of Atlas Cloud, drawn largest, with its database in a keep of its own, its storage and its secrets). Information runs both ways on every line to and from Gradeum Keystone. The numbered steps below describe each connection.Microsoft 365Microsoft AzureYour Microsoft tenantGradeum’s Microsoft cloudThrough your Entra IDExchange OnlineProtectionEmail a taskMalware and spamfiltersHTTPS,TLS 1.2 or higherBuilt-in virus detectionLimited to this one mailboxYou and your teamBrowser and emailMicrosoft Entra IDYour sign-in policiesATLAS mailboxExchange OnlineYour Atlas folderSharePoint, open in your OneDriveGradeum KeystoneDatabaseAzure Database for PostgreSQLStorageAzure Blob StorageSecretsAzure Key VaultEncrypted at rest12334456

  1. Sign in at your own Microsoft Entra ID.

    Sign-in happens at Microsoft, under your organization’s own sign-in policies. Multifactor authentication and the Conditional Access policies your IT sets for all apps apply here too. Everything starts with your team’s own Microsoft sign-in: the web app, the mail they send to the ATLAS mailbox, and your Atlas folder.

  2. Into Gradeum’s Microsoft cloud, over HTTPS.

    Traffic between you and Gradeum is encrypted with HTTPS (TLS 1.2 or higher).

  3. Or email a task.

    Mail to the ATLAS mailbox passes Exchange Online Protection: Microsoft’s malware, spam and phishing filtering, on by default for every cloud mailbox. ATLAS’s mail access is limited to the ATLAS mailbox alone.

  4. Your files, in your firm’s Atlas folder.

    Your team opens it in their own OneDrive, signed in through your Microsoft Entra ID. Microsoft’s built-in virus detection scans files that users upload to SharePoint and OneDrive.

  5. Stored encrypted, in Microsoft Azure.

    Documents are encrypted at rest with Microsoft-managed keys.

Some models offered through Azure AI Foundry, including Anthropic's, are hosted by their maker outside Microsoft's own infrastructure.

Privacy Policy, section 4

Atlas Local In testing

Your storage, mail and folders stay local. Local, the hub on your side, tokenizes, chunks and indexes your files for search (RAG). Only what you approve leaves, through Gradeum Keystone, to the models.

Atlas Local’s data flow, drawn as fortresses. Your firm’s wall holds your team, your Microsoft Entra ID, and Local, the hub on your side, with your folders, mail and storage, which it tokenizes, chunks and indexes where they are. What you approve leaves, and every send is logged on your drive. It goes out through Gradeum Keystone in Gradeum’s Microsoft cloud, and the answer comes back the same way.Kept localMicrosoft AzureYour firmGradeum’s Microsoft cloudYour Microsoft sign-inIndexed where they areYou see and decidewhat leaves.Every send loggedIts database and secrets,as in Atlas CloudMicrosoft Entra IDYour sign-in policiesYou and your teamBrowser and emailLocalTokenization, chunking and RAGSend logChained, on your driveYour foldersNever moveYour mailStays localStorageStays localGradeum Keystone

The hosted line

Atlas Cloud

Where do our files go?

Each firm has an Atlas folder, held for you in Gradeum's Microsoft 365 (SharePoint) and shared with your firm's users. You can open it from the link we send or add it to your own OneDrive as a shortcut. Atlas reads and writes files in that folder. Atlas also holds a private storage area for each account. When the folder is over its size limit, the oldest inactive files are moved from the folder to that private storage; they stay available to Atlas and to you on request.

Terms of Service, section 5

Atlas writes new files; it does not overwrite your originals.

What is sent to AI models, and who runs them?

Some models offered through Azure AI Foundry, including Anthropic's, are hosted by their maker outside Microsoft's own infrastructure.

Privacy Policy, section 4

Documents and messages a customer attaches to a task are sent to the AI models in Gradeum's Azure AI Foundry to perform the task.

Privacy Policy, section 4

We do not use your content to train our own models.

Privacy Policy, section 4

Batch tasks: the provider may hold results for up to 29 days. Zero data retention is not in place for batch.

Privacy Policy, section 4

Azure AI Foundry account: Central US. Its model deployments are Global Standard, which means Microsoft may process requests in any region. We do not claim US-only processing.

Privacy Policy, section 6

How do we sign in, and who can see our files?

Sign in with your Microsoft work account.

One account per firm. The person who pays is the admin and invites the firm’s users.

Each firm has its own account.

Privacy Policy, section 8

Gradeum staff access customer data only where needed to run, support or secure the service.

Privacy Policy, section 9

ATLAS’s mail access is limited to the ATLAS mailbox alone, by Exchange Online RBAC for Applications.

No other mailbox is reachable by the app.

Microsoft may show an unverified-publisher notice when your administrator first approves the Atlas Cloud app.

Terms of Service, section 13

What is logged, and what is not?

Every engineer decision is logged.

We keep a log of engineer decisions made in Atlas. It is kept while your account is active and deleted with your other Customer Content under section 8; the administrator may ask us for an export of it at any time before then.

Terms of Service, section 5

Usage and credit records. Tasks run, credit used per task, the engineer decision log, and every model call, including chat turns. These are metered to the firm's credit.

Privacy Policy, section 2

Usage and credit records: seven years, for billing, tax and disputes.

Privacy Policy, section 7

Operational logs. Logs hold codes, counts and technical events, not document text. They are kept no longer than 12 months.

Privacy Policy, section 2

How is it secured?

Atlas Cloud runs on Microsoft Azure, with the web app and database held in Gradeum’s Azure subscription.

Service secrets for the live services are held in Azure Key Vault.

Documents are encrypted at rest with Microsoft-managed keys, and traffic between you and Gradeum is encrypted with HTTPS (TLS 1.2 or higher).

No system is perfectly secure. We hold no security certifications and do not claim any.

Privacy Policy, section 9

What happens when we leave?

Download anything you want to keep from your Atlas folder before you close the account.

Terms of Service, section 8

We will delete or return the Customer Content we hold, including your Atlas folder and private storage, within 30 days of account closure, and it is removed from our backups within 35 days of closure, subject to the retention rules in the Privacy Policy and legal duties.

Terms of Service, section 8

When a user leaves, their memory is kept 30 days, can be transferred on the person’s request for a fee, and is then deleted.

Who do we ask?

Email: support@gradeumtech.com …

Terms of Service, section 17

privacy@gradeumtech.com …

Privacy Policy, section 13

Choosing a line

Two lines, and your choice

You choose your level of security. No law yet sets a level of security for AI in engineering work. The duty to keep a client’s information confidential is already in the profession’s rules.

Licensees shall not reveal facts, data, or information obtained in a professional capacity without the prior consent of the client, employer, or public body on which the licensee serves except as authorized or required by law or rules.

NCEES Model Rules (August 2025), section 240.15 B.4

Atlas Local is the more secure line.

Atlas Local, the more secure line

In testing

Atlas Local will cost more because it is the more secure line, for the firm whose client, contract or conscience asks for more.

Your files never move. ATLAS indexes them where they are and never writes to your shares. Finished work goes to your own Documents folder.

You see and decide what leaves. Every send is logged word for word on your drive, in a chained log you can check.

ATLAS brings its own small AI models that work on your computer to find, sort and keep track of your files.

Coming

Gradeum will offer two levels of security, one in each line.

We are building a Burn button for Atlas Cloud: you will press it, everything about that project will be destroyed, and you will keep only the proof that it happened.

Read them in fullTerms of ServicePrivacy Policy

BE AN ENGINEER AGAIN.

ATLAS, by Gradeum. A defensible, auditable AI for engineering work.

Get started See how it works

Sign in with your Microsoft work account. By creating an account you accept the Terms of Service and the Privacy Policy.