Security

• Store API keys and webhook secrets in environment variables, not source control.
• Use Test keys (abk_test_…) in staging and Live keys (abk_live_…) in production. Do not mix modes.
• Rotate keys and webhook endpoint secrets if they may have leaked.

Verify the x-autlantic-signature header against the raw request body and the signing secret for that endpoint before trusting an event.

Customer USDC settles on Base to the merchant payoutAddressEvm. Autlantic does not custody customer subscription revenue.

Autlantic may operate relayers to sponsor gas and submit billing transactions. Relayers are not used to custody customer or merchant subscription balances. See Settlement overview.

Merchants sign in with email and password. Google sign-in is available when enabled for the deployment. Enterprise SAML 2.0 and OIDC SSO for the merchant portal is WorkOS-backed and available on request (invite-only seats). Contact [email protected] to scope Okta, Microsoft Entra ID, Google Workspace, or a similar IdP. Self-serve IdP configuration in Settings is not live yet. See the company Security FAQ.

Report suspected security issues privately to [email protected]. Include enough detail to reproduce the issue without sharing production secrets in public channels.

For procurement and security review, see the company Security FAQ and DPA outline. The DPA page is a draft for negotiation, not an executed agreement.

Developer docs: Security guide · Terms · Community Guidelines