Security

How ATHELOS handles security, incident response, and vulnerability disclosure.

Reporting a vulnerability

If you believe you have found a security issue in ATHELOS, email security@athelos.pro. We acknowledge reports within 24 hours and aim to confirm or dismiss within 72 hours.

Incident response

Our incident response plan follows GDPR Articles 33–34 and NIST SP 800-61. Confirmed Personal Data breaches are notified to affected customers within 24 hours, and to the Irish Data Protection Commission within 72 hours where required by law.

Data protection

Details of what personal data we process, why, and for how long are in our Privacy Policy. Our sub-processors are listed in the Sub-Processor List.

No telemetry, no analytics

ATHELOS does not include telemetry, analytics, advertising trackers, or third-party tracking scripts. AI features run on a locally-hosted Ollama model — no customer data is sent to any third-party AI provider.