Security and data handling

What this template does with data: almost nothing.

ATLAS is a front end over a generated dataset. Being precise about what it does and does not do is more useful than a badge wall.

This page describes the template’s behaviour. It makes no compliance claim and no certification claim of any kind. Anything you build on top of it is your own responsibility to assess.

Behaviour

What the running application does.

Makes no outbound network request to any third party at runtime
Loads no external font, script, stylesheet, image or map tile
Stores nothing on a server — there is no database and no write path
Uses browser localStorage for exactly three values: theme, light or dark mode, and demo role
Generates the entire demo dataset in memory from fixed seeds on each cold start
Sends no analytics, telemetry or error reporting anywhere
Blocks indexing of every console route with a robots directive and an X-Robots-Tag header

What is deliberately absent

And what you would need to add.

Authentication and sessions
No sign-in exists. The role switcher changes navigation and workspace visibility only; it is not an authorisation boundary.
Server-side authorisation
The role matrix is presentational. A production deployment must enforce the same matrix on the server for every read and write.
Transport and storage security
There is no data at rest and no user data in transit, so there is nothing here to encrypt. Both become your concern once persistence is added.
Audit integrity
The audit log is generated demo data. A real implementation should write it from the same service layer that performs the change, append-only.
Secret management
No credentials or API keys exist anywhere in the codebase, because no integration is live.

Demo data

No real people, no real companies.

Every customer, supplier, driver, contact, address, phone number and email in the dataset is generated from fixed word lists and a seeded random number generator. Company names are invented; the five named real-world carriers and the payment, mapping, CRM and ERP vendors appear only as integration targets.

All email addresses use the reserved .example domain and cannot receive mail
Addresses are jittered city centroids, not real premises
Proof-of-delivery signatures are drawn from a seed; no image is stored or uploaded
Money is generated in integer minor units and never leaves the browser session

Check it yourself.

Open the network tab while you use the console — the only requests are to this application.

Open the console Read the privacy note