# Atmosphere security and deployment review guide

Version 1.0 | Published 12 August 2026

## Purpose

This guide identifies the questions used to frame an Atmosphere technical review. It is not a certification, penetration-test report, or substitute for a deployment-specific security assessment.

## Identity and access

- Which system is authoritative for users, organisations, roles, and device identity?
- Are multi-factor authentication and trusted-device requirements defined?
- How are site, portfolio, installer, operator, and market scopes separated?
- Who approves, changes, and reviews access?

## Credentials and integrations

- Where are external participant, device, and market credentials held?
- How are credentials issued, rotated, revoked, and recovered?
- Which interfaces accept commands and which are read-only?
- How are request, acknowledgement, timeout, and retry behaviours recorded?

## Operational authority

- Which actions require an operator preview or explicit approval?
- What customer, device, site, and programme constraints must be applied?
- What happens during loss of connectivity or partial system availability?
- Which party owns rollback, recovery, and incident response?

## Audit and evidence

- Which authentication, configuration, request, command, and result records are required?
- How long should records be retained and who may access them?
- What telemetry or event evidence supports operational verification?
- Which evidence is required for programme, regulatory, or market review?

## Deployment boundary

Cloud, hybrid, and site-resident responsibilities should be selected against control latency, connectivity, recovery, residency, and institutional requirements. The final architecture and responsibility matrix are agreed during technical discovery.

Contact hello@myatmosphere.co.uk to request a security and deployment review.