Security
Security at Atlas
Atlas is built around local-first repository analysis and explicit user-controlled context sharing.
Indexing
Atlas reads the selected folder on your machine. Nothing is transmitted.
Storage
Scans, graphs, and repository memory live in ~/.atlas_desktop on your disk.
MCP retrieval
Your agent queries Atlas over local stdio. Atlas itself transmits nothing off-machine; your agent may forward requested context to its own configured model provider.
Agent path
Your connected agent may send retrieved context to its own model provider under that provider's terms.
Analytics
Pseudonymous events (random per-installation id): event names, timings, and app version only - never repository contents, names, paths, file names, prompts, answers, secrets, or MCP payloads. Can be disabled in Settings.
Billing
Payment details are handled by Paddle as Merchant of Record. Atlas never stores card data.
Local-first architecture
Repository indexing runs on your machine. Atlas reads the selected local folder, builds a dependency graph and prepares repo-aware answers without uploading repository contents during indexing.
Authentication
Atlas account sessions use signed, httpOnly cookies. Passwords are stored as salted hashes, never plaintext. Admin access is role-based and separated from normal user account flows.
Billing
Paid subscription billing is handled by Paddle as Merchant of Record. Atlas never stores your payment details.
Deleting local Atlas data
Everything Atlas knows about your repositories lives in one folder. To delete it without uninstalling: close Atlas, then delete %USERPROFILE%\.atlas_desktop (scans, indexes, repository memory, local analytics, and logs). Uninstalling Atlas removes both the application and that data directory - a full uninstall leaves no repository data behind. MCP config backups are stored next to each agent's config file as *.atlas-backup-<timestamp> and are yours to keep or delete.
Responsible disclosure
If you believe you found a security issue, email yoavkozokabab@gmail.com with a description, reproduction steps and any relevant impact. Please do not publicly disclose the issue until we have had a reasonable opportunity to investigate and respond.
We aim to acknowledge security reports within two business days.
Security contact
For non-sensitive security questions, you can also contact us through support.
Last updated: 2026-07-09.