Written for the engineer your security team sends to the first call.

Where code runs

Every code run in an Atelo course executes inside an isolated sandbox with no filesystem of its own and no network access at all. Not on a shared OS shell, and never with a path to your infrastructure or ours.

Your API is simulated, never called

Onramp courses are built from your public documentation: your docs site, API reference, or a spec, whatever is usable. From it we compile a deterministic simulation of your API that lives entirely inside the sandbox. Developers authenticate against it with obviously fake keys, create and query objects, trigger your documented error shapes, and replay idempotent requests.

Three things your security team will want in writing:

• We never ask for production credentials. Not yours, not your customers', not the learner's.
• Learner code never touches your infrastructure. There is no network in the sandbox; the simulation is the API.
• Nothing a learner types leaves their course. Runs are graded automatically and stored only as that learner's own progress.

What we store

For a team deployment we hold: the docs you gave us, the compiled course content, each learner's progress inside that course, and the roster your admin manages. We do not scrape private repos, we do not request repo access, and we do not train models on your material.

We sign a data processing agreement with every pilot partner before any learner data flows.

AI generation, honestly

Courses are AI-generated and then forced through a verification pipeline: every code block is executed before delivery, an independent AI reviewer grades the output, an editor repairs anything that falls below the bar, and a second, fresh reviewer confirms the fix. Nothing unverified ships. Course generation runs on DeepSeek models via API. The Ada tutor runs on Anthropic Claude (Haiku). Neither provider receives learner personal data, so none of it is ever used to train a model.

Payments and access

Checkout is Stripe hosted; card data never touches our servers. Access is verified server side on every unlock, invite links are single use and expiring, and admin rights are enforced in the data layer, not the UI.

Current posture, stated plainly

We are a young product and we will not pretend otherwise. We do not yet hold SOC 2 or ISO 27001. SOC 2 Type I is targeted for the first half of 2027. This overview plus direct engineering answers are available now; a formal controls document is prepared as part of pilot onboarding. If your review needs a control we do not have yet, tell us which one; the honest answer plus a date beats a checkbox.