The short version
The analyser is a local process. It reads files from a folder you choose and writes its result back next to that folder. There is no Atlas server that receives your source code, and no analytics or telemetry of any kind is collected.
What is stored, and where
Beside your project
When you scan a project, Atlas writes to a .atlas.api/ directory inside it:
api.json— the discovered endpoints, fields, responses and findings.captures.json— responses you explicitly chose to save, including their bodies and headers.comments.json— comments left on endpoints, if you use collaboration.environments.json— environment variables you entered, including any secrets you put in them.
A .gitignore is created in that directory automatically, but you control whether these files are committed. Treat captures and environments as sensitive: a captured response can contain real data, and an environment can contain a real token.
In your home directory
Files under ~/.atlas.api/ are shared across projects:
projects.json— the list of projects you have opened, so they appear on the projects page.users.json— accounts, if you create one. Contains an email address, a display name, and a scrypt hash of the password. Plaintext passwords are never written. One-time codes are stored hashed as well, expire after ten minutes, and are deleted the moment they are used.sessions.json— session tokens for signed-in accounts. Expired rows are removed whenever a new session is created.feedback.json— suggestions submitted through the feedback box.
These files are written with owner-only permissions. Deleting them deletes the data completely — there is no other copy.
In your browser
Only two things. Your theme choice is kept in localStorage, and your session is an httpOnly cookie that JavaScript on the page cannot read. Discovered API data is deliberately never put in browser storage.
What leaves your machine
Requests you send from the request panel go to whatever host you point them at — that is the entire purpose of the feature, and it is the one case where data leaves. They are proxied through the local process so the browser's CORS rules do not block them, which means the target server sees the request as coming from your machine.
Two optional features also reach the network, and only when you use them:
- Importing from GitHub contacts GitHub's API with a token you supply, to download the repository you named.
- Sending a one-time code by email posts to the webhook you configure in
MAIL_WEBHOOK_URL. If you configure nothing, no email is sent and the code is shown on screen instead.
Accounts are optional
Scanning, testing, captures, environments and exports all work with no account at all. An account exists only so that comments and feedback can carry a name, and creating one asks for an email address, a display name and a password.
Deleting your data
Remove the .atlas.api/ folder inside a project to erase everything about that project, and remove ~/.atlas.api/ to erase accounts, sessions, the project list and feedback. Nothing is retained elsewhere, so there is no request to make and no backup to expire.
Who is responsible
Because Atlas runs locally, the operator of any given instance is whoever runs it — usually you. If someone else hosts an instance for you, they control the files described above and their own policy applies on top of this one.