Security

Security at Atlas

Atlas is built around local-first repository analysis and explicit user-controlled context sharing.

data flowdeterministic
01

Indexing

Atlas reads the selected folder on your machine. Nothing is transmitted.

02

Storage

Scans, graphs, and repository memory live in ~/.atlas_desktop on your disk.

03

MCP retrieval

Your agent queries Atlas over local stdio. Atlas itself transmits nothing off-machine; your agent may forward requested context to its own configured model provider.

04

Agent path

Your connected agent may send retrieved context to its own model provider under that provider's terms.

05

Analytics

Pseudonymous events (random per-installation id): event names, timings, and app version only - never repository contents, names, paths, file names, prompts, answers, secrets, or MCP payloads. Can be disabled in Settings.

06

Billing

Payment details are handled by Paddle as Merchant of Record. Atlas never stores card data.

What stays on-device?
repository fileslocalread during scanning on your machine
dependency graphlocalstored in the Atlas data directory
context packetsuser-controlledleave only when you copy or send them

Local-first architecture

Repository indexing runs on your machine. Atlas reads the selected local folder, builds a dependency graph and prepares repo-aware answers without uploading repository contents during indexing.

Authentication

Atlas account sessions use signed, httpOnly cookies. Passwords are stored as salted hashes, never plaintext. Admin access is role-based and separated from normal user account flows.

Billing

Paid subscription billing is handled by Paddle as Merchant of Record. Atlas never stores your payment details.

Deleting local Atlas data

Everything Atlas knows about your repositories lives in one folder. To delete it without uninstalling: close Atlas, then delete %USERPROFILE%\.atlas_desktop (scans, indexes, repository memory, local analytics, and logs). Uninstalling Atlas removes both the application and that data directory - a full uninstall leaves no repository data behind. MCP config backups are stored next to each agent's config file as *.atlas-backup-<timestamp> and are yours to keep or delete.

Responsible disclosure

If you believe you found a security issue, email yoavkozokabab@gmail.com with a description, reproduction steps and any relevant impact. Please do not publicly disclose the issue until we have had a reasonable opportunity to investigate and respond.

We aim to acknowledge security reports within two business days.

Security contact

For non-sensitive security questions, you can also contact us through support.

Last updated: 2026-07-09.