Security outcomes on data that stays in your network.
See attacks as they happen, explain incidents in minutes, control personal data and stop fraudulent payments. Each use case runs inside your own infrastructure and starts with a pilot you measure.
Where teams start.
Start with what is ready fastest, then grow from the same data.
- 1
Security dashboard and alerts
Ready-made, no change to your applications, and a 30–45 day pilot.
- 2
Incident RCA agent
Runs on the same logs, so it follows as soon as the dashboard is live.
- 3
DPDP / GDPR-ready lakehouse
For teams with customer data spread across systems, brought in source by source.
- 4
Fraud detection
For banks, NBFCs and fintechs, built with your teams next to your approval flow.
Security incident dashboard and alerts
See every request hitting your websites and APIs: who is attacking, what was blocked and what got through. Kept on your own servers, at a cost that lets you keep all of it.
Who it's for
For CISOs, SOC, NOC and SRE teams at banks, fintechs, OTT and e-commerce.
- CDN and WAF logs are the fullest record of attacks, but volume-priced SIEMs make them too expensive to keep in full.
- CERT-In's 2022 directions require cyber incidents to be reported within 6 hours and ICT logs to be kept for 180 days in India.
The questions it answers
- “A traffic spike: is it demand, a fault, bots or an attack?”
- “Which WAF rules are firing, and what still reached the origin?”
- “What did this IP do in the last hour?”
What you get
- Security dashboard
- WAF rules firing, blocked and rate-limited requests (403 / 429), attacking IPs, bots versus humans, by country, ASN and endpoint.
- Five more dashboards
- Traffic, errors (edge versus origin), raw log search, performance (p50 / p95 / p99) and cache efficiency.
- Raw log search
- Every request, filterable by client IP, path, status and request ID.
- Alerts
- The responsible team is notified when the conditions you agree are met.
- Chat with your logs
- Ask when errors began, which regions are hit and whether the requests look automated.
How it works
- Sources
CDN and WAF logs, then API, application and login logs
- Ingest
A streaming collector inside your network
- Store
Open formats (Iceberg, Parquet) on your own storage
- Use
Dashboards, alerts, search and chat for SOC, NOC and SRE
What we set up with you
We connect the log sources you choose, such as API gateway, application, authentication and firewall logs, and build the panels and alert rules your team needs.
The pilot · 30–45 days
- Your CDN plus one or two critical services.
- A baseline for traffic, errors and latency.
- Alerts for the conditions you agree.
- Chat on the connected data, then a findings review.
How it's measured
- Coverage of the agreed channels and log sources.
- Time from an incident condition to an alert.
- Time to find the affected service.
- Actionable alerts out of all alerts.
Alongside what you already run
- Your SIEM
- Stays. atompulse keeps the high-volume logs at low cost and forwards alerts or summaries.
- WAF and CDN consoles
- atompulse joins the edge view with your own API and application logs.
An unusual pattern is a lead for your security team to assess, not a confirmed attack.
Incident RCA agent
After an alert, get the timeline, the blast radius and the most likely cause, with the evidence attached, in minutes instead of a war-room afternoon.
Who it's for
For SOC managers, incident response leads and CISOs who report incidents.
- The 6-hour CERT-In reporting window leaves no time for a manual hunt across tools.
- Triage takes most of an analyst's day.
The questions it answers
- “When did it start, what did it touch, and why?”
- “Was it an attack, a bad deployment or real demand?”
- “What evidence goes in the incident report?”
What you get
- Baseline
- What normal looked like before the incident.
- Localise
- Which routes, regions, IPs, user agents and accounts were affected, and from when.
- Correlate
- Lines the incident up with deployments, configuration and WAF rule changes, and error spikes.
- Challenge
- Tests demand, fault, abuse and attack, and says what the data can't rule out.
- Report
- A timeline and evidence pack your team reviews and uses for its incident report.
How it works
- Trigger
An alert, or an analyst's question
- Investigate
The Log Analyst takes the steps a careful engineer would
- Explain
The RCA agent ranks the likely causes and shows what it tested
- Hand over
The evidence pack goes to your team, who decide and respond
What we set up with you
We tune the investigation to the patterns you see, such as credential stuffing, scraping, traffic floods or WAF bypass, and connect your change and deployment history.
The pilot · On the same data
- Uses the logs from the dashboard pilot, so there's no new integration.
- Replays 3–5 past incidents your team already understands.
- Compares the agent's timeline and cause with your team's findings.
How it's measured
- Time from alert to explanation.
- Agreement with your team on replayed incidents.
- Alerts closed with an evidence pack.
Alongside what you already run
- SOAR
- SOAR automates the response; the agent explains what happened.
- SIEM rules
- Rules flag known patterns; the agent investigates once an alert fires.
The agent investigates and recommends. It never blocks, changes or remediates anything on its own.
DPDP / GDPR-ready lakehouse
Know every place a customer's name, email or mobile number is stored. Show it masked by default, release it only with approval, and prove who saw what.
Who it's for
For CISOs, DPOs, CIOs and heads of data at banks, insurers, NBFCs, healthcare and any business holding customer data.
- India's DPDP Act 2023 and Rules 2025 apply in phases. The Act allows a penalty of up to ₹250 crore for failing to take reasonable security safeguards, a maximum rather than an automatic fine.
- GDPR fines reach €20 million or 4% of worldwide annual turnover, whichever is higher.
The questions it answers
- “Where is customer personal data stored today?”
- “Who can see raw mobile numbers, and do they need to?”
- “Can we prove how one customer's data was handled?”
What you get
- Classify on arrival
- Personal data is identified and tagged as each source is brought in.
- Mask and encrypt
- Configured controls protect identified fields in storage and on access.
- Masked by default
- A role that doesn't need the raw value never sees it.
- Approval for raw values
- A raw email or mobile number is released only on an approved request, and the access is recorded.
- Access record and lineage
- Who accessed governed data, when and through which process; where it came from and where it's used.
- Erasure at scale
- Crypto-shredding, a consent ledger and separate DPDP and GDPR workflows.
- Entitlement
- Role-based access, table approvals and data stewards, enforced in the data layer, including for atomiq's answers.
How it works
- Sources
Core systems, CRM, KYC, apps and files, one at a time
- Govern
Classify, mask, encrypt and tag as data lands
- Control
Role-based access, approvals for raw values, a full audit
- Prove
Lineage, access records and evidence on request
What we set up with you
We agree with you which sources come first, the approval rules, the encryption approach and retention, and connect atomhub to your privacy, consent and request processes.
The pilot · Two or three sources
- Two or three critical sources; for a bank, core banking and KYC.
- Personal data found and classified, with masked-by-default reports.
- One approval-based request for a raw value, run end to end with its evidence.
How it's measured
- In-scope sources and fields identified.
- Identified personal data under masking and encryption.
- Raw access routed through approval and recorded.
- Time to locate data and produce evidence.
Alongside what you already run
- DLP
- DLP watches data leaving; atomhub governs the platform where it's stored and used.
- Privacy and consent tools
- They manage notices and consent; atomhub enforces the controls on the data and supplies the evidence.
atomhub provides the data-platform controls for DPDP readiness. Notices, consent, vendor contracts and incident processes stay with you, so a lakehouse alone doesn't make a company compliant.
Fraud detection
Stop the fraudulent payment without stopping the genuine ones, and give the investigator the evidence behind every flag.
Who it's for
For MDs, CIOs, CISOs and heads of fraud risk at banks, NBFCs and fintechs.
- RBI's Commercial Banks Fraud Risk Management Directions 2026 call for prevention, early detection and an early-warning framework.
- Other BFSI entities map this to their own regulator's directions.
The questions it answers
- “How many genuine customers do we decline to catch the fraudulent ones?”
- “When a payment is held, does the reviewer see why?”
- “How long until a new fraud pattern is in our rules?”
What you get
- Decision API
- Runs next to your approval flow and returns Approve, Reject or Step-up for each in-scope transaction.
- 50 ms decision target
- Agreed as an acceptance KPI and tested at your own transaction load.
- Evidence with every Step-up
- Transaction details, triggered rules, risk signals and related activity for the reviewer.
- Your controls stay
- Your rules engine and approval process remain. Finacle-based environments are supported, subject to the interfaces available.
- Data for better rules
- Prepared transaction and case data for analysts; reviewer outcomes become labelled data.
How it works
- Transaction
A payment reaches your approval API
- Decide
Rules outcome plus velocity signals, within 50 ms
- Investigate
Step-up cases reach a reviewer with the evidence
- Learn
Outcomes are labelled to refine rules and test models
What we set up with you
Built with your fraud and payments teams: the integration with your approval flow and rules engine, the transaction types and channels in scope, and your review policy. Models are tested on your labelled outcomes before they affect a live decision.
The pilot · One transaction type
- A joint baseline, scope and acceptance criteria.
- One transaction type and channel first.
- You keep final authorisation; review happens after the API response, outside the 50 ms target.
How it's measured
- Decision response time at the agreed load.
- Fraud caught and missed against the baseline.
- False rejects and genuine transactions sent to Step-up.
- Review time and quality of evidence.
Alongside what you already run
- Your fraud engine
- Works next to it and adds the evidence and the data loop; it doesn't replace it on day one.
- Core banking
- Connects through your approval flow, subject to the interfaces available.
Built to be trusted with security data.
Read more on the security and compliance page.
- ISO/IEC 27001
- Certified by an independent auditor.
- Your infrastructure
- Your servers, your cloud account or fully air-gapped.
- Open formats
- Iceberg and Parquet on your own storage. No lock-in.
- 2B+ requests a day
- 200M+ concurrent viewers at an OTT platform's peak, with no data lost.
Questions
Does this replace our SIEM?
No. atompulse keeps high-volume logs such as CDN, WAF and application logs at low cost and forwards alerts or summaries to your SIEM, which stays in place.
Does any data leave our network?
No. Every use case runs on your servers, in your cloud account or fully air-gapped, on open formats you own.
How long does a first pilot take?
The security dashboard pilot takes 30 to 45 days. It starts with your CDN and one or two critical services, with no change to your applications.
Will the agents take action on their own?
No. The agents investigate and explain, with the evidence. Your team decides and responds.
Does a DPDP-ready lakehouse make us compliant?
It provides the data-platform controls and the evidence. Notices, consent, vendor contracts and incident processes remain yours.
Which security problem should go first? Tell us what you protect today; we'll suggest the pilot that proves value fastest.
Book a demo →