Security at Atli

When you travel with Atli, you trust us with a payment, an account and the eSIM that keeps you connected abroad. We take that seriously. Whether you buy on heyatli.com, in our app, through Telegram or WhatsApp, or with help from an AI assistant, every route leads to the same protected core. Each part of it is built so that sensitive information goes only where it is needed and nowhere else. #

Payments #

Card payments are handled by Stripe, a payment processor certified to PCI DSS Level 1, the highest level of the card industry's security standard. You type your card details only into Stripe's secure form. They never pass through Atli's servers, and Atli never sees your full card number: a saved card is shown only by its brand and last four digits. Every payment also passes through Stripe's fraud prevention, which learns from payments across millions of businesses and stops suspicious ones before they go through. Your bank can still ask you to confirm a payment with 3-D Secure. #

Payment links are encrypted and digitally signed, so nobody can read, change or forge one. We check the signature on every message Stripe sends us about a payment before acting on it. Every request we send to Stripe and to our eSIM provider carries a one-time key, so a retry can never charge you twice or issue a second eSIM. #

Your account #

Atli has no passwords that could be guessed, reused or leaked. You sign in with a one-time code sent to your email, with Google, Apple or Facebook, or by approving the sign-in in your own Telegram or WhatsApp chat with our official bot. Email codes expire after 10 minutes and allow five attempts, after which the address is locked for half an hour. We never store the codes themselves: each one is derived from a server secret and checked without being saved. #

Once you are in, your session uses access tokens that are encrypted and last 15 minutes. They are renewed in the background with single-use refresh tokens, which we store only as fingerprints (hashes). If an old refresh token is ever used again, we treat it as stolen and end the session. Requests from our Telegram and WhatsApp bots are signed and time-stamped, so they can't be forged or replayed. When you let another app act for you, you approve it yourself on heyatli.com, after seeing exactly which app is asking and where it will send you, and you can take that access away whenever you like. #

Your data #

We collect what we need to sell you an eSIM, get it working and support you. Every account can see only its own orders, eSIMs and receipts. The activation code that installs an eSIM is shown only to you, on a private page. Everything travels encrypted: with HTTPS between you and us, and over encrypted connections between our services and our database. Records for guests who buy through an AI assistant are encrypted at rest (AES-256-GCM). #

The keys and passwords our systems use never live in our code: they are kept in a managed secret store and loaded only when a service runs. Analytics and error tracking never run on our payment and sign-in pages, and our error reports are set up not to collect personal data. You can close your account at any time, which signs you out everywhere at once and cuts off every app you connected. #

Infrastructure and bot protection #

Our websites and services run on Cloudflare's global network, which carries traffic for a large share of the internet and absorbs attacks such as floods of traffic before they reach us. Our core API runs on Amazon Web Services in several copies at once, so one failing doesn't take the service down, and test and production run separately. #

Against bots, rate limits cap how often anyone can try something, such as asking for sign-in codes, guessing voucher codes, requesting prices, buying or creating accounts. Daily limits on top of that stop automated scripts from wearing the system down slowly. Our own services prove who they are to each other with cryptographic signatures. Our sign-in pages can't be loaded inside other websites, which blocks a common trick for stealing clicks. #

How we build and check Atli #

Every change to Atli goes through a pull request and is checked automatically before it is released. That means around 1,400 automated tests on our websites and AI server, plus tests for our API that run against a real database. Changes to our core API also need a second engineer's approval and signed commits, and automated security rules check each one for mistakes such as a secret written to a log. A separate test environment, with accounts of its own, is where new features are tried out. Changes made by Atli's own staff, and by the managers of company groups, are recorded in audit logs. #

For businesses #

Companies that pay for their team's travel through Atli Groups manage it with roles and permissions, so each person can only do what their role allows. They set spending limits per purchase, per person and per month. Anyone who joins through the company's email domain is let in only after the domain is proven through a DNS record. Every change to the group is recorded in a log the company can review. #

AI assistants #

You can also buy and manage eSIMs from AI assistants such as Claude and ChatGPT. They connect through the same protections, using OAuth 2.1, the open standard behind "Sign in with Google". Card details never enter the chat, and an assistant can only buy after you agree to it in the conversation. #

Our team #

Security at Atli is led from the top. Our CTO holds a master's degree in information security and has led an exchange, as well as risk-scoring and fraud-prevention initiatives, and advised multiple corporates and hedge funds on security and best practices. That experience shapes how Atli is built: sensitive data stays where it belongs, every request is checked, and every layer assumes the one in front of it might fail. #

Found a vulnerability? #

We welcome reports from security researchers and ethical hackers. If you think you have found a weakness in any part of Atli, please email security@heyatli.com with what you found and how to reproduce it. Give us a reasonable time to fix it before you share it publicly, and don't access or change other people's data while testing. We read every report and will get back to you. #