Trust & Security

Our approach

Project Atlas is a decision tool for commercial teams, so keeping it available, accurate, and access-controlled matters. We take a pragmatic, defence-in-depth approach: authenticate every request to the application, transmit everything over encrypted connections, store secrets safely, and actively limit abuse.

We describe below the measures that are actually in place. We do not claim certifications we don’t hold.

Authentication & access control

• The entire application sits behind authentication — only signed-in accounts can reach any page or API beyond the public marketing site.
• Passwords are never stored in plain text; they are kept only as salted hashes.
• Sign-in attempts are rate-limited to slow credential-stuffing and brute-force attacks.
• Roles gate sensitive areas (for example, the usage-analytics admin area) so accounts only see what they should.

Data in transit & at rest

• All traffic is served over HTTPS/TLS.
• Session identity is carried in a signed token that cannot be forged by setting request headers.
• Access credentials and connection secrets are held in server-side environment configuration, not in client code.

Abuse & rate limiting

To keep the service fast for everyone and to protect the dataset, we apply layered rate limits — per-IP and a second ceiling per authenticated account — with tighter limits on the most expensive endpoints. Automated bulk extraction of data is detected and blocked, and may result in account suspension and legal action (see our Usage Policy).

Data provenance

The market data in Project Atlas is compiled from public and open sources (PSA, DHS, BIR, DOT, OpenStreetMap, and published research) into a curated dataset. Every dataset and study behind the numbers is catalogued inside the app on the References and Library pages, so figures can be traced to their source.

Reporting a vulnerability

If you believe you have found a security issue, please report it responsibly through your Project Atlas account representative before disclosing it publicly. We appreciate good-faith reports and will work with you to confirm and address the issue.

Availability

The platform is hosted on managed cloud infrastructure with health monitoring. While no service can guarantee 100% uptime, we design for reliability and investigate incidents promptly.