// MODULE 06 — ATLAS
Planned

Your portal, your domain, your brand.

The same encrypted gate and per-client report shells we use, packaged for agencies and consultants delivering reports to their own customers. Your domain. Your brand. The same at-rest encryption that protects every WildBreeze client report.

Status: Planned · 2026 Encryption: PBKDF2 + AES-GCM Hosting: Your domain Audience: Agencies, fractional ops
001 — How it works

Three steps. No glue code on your side.

Every module is a fixed shape. We deploy it into your cloud, hand over the keys, and step out of the room.

// 01
STEP 01 — DOMAIN

Your domain, your brand

Atlas runs at portal.youragency.com or wherever you point a CNAME. The visible surface is yours: logo, palette, copy, footer. The encryption layer is the same one we use.

// 02
STEP 02 — CLIENTS

Per-client credentials, scoped from day one

Each client gets an email + access key pair. The gate derives a key via PBKDF2 (200k SHA-256) and decrypts that client's manifest. One client never sees another client's existence.

// 03
STEP 03 — REPORTS

Drop reports as encrypted shells

Each report is a self-contained, encrypted-at-rest HTML file. Drop into the client's directory; the manifest updates; the client sees the new entry on their next login. No share-link expiration, no third-party report viewer.

002 — Inside the module

What's actually in Atlas.

The capabilities that make this module the right shape, not just the right name.

// 01

Per-client credentials

Email + access key per client. PBKDF2-derived. No shared 'agency password'.

// 02

At-rest encryption

Reports ship as ciphertext. The server never holds the key in clear.

// 03

Your domain, your brand

CNAME to your subdomain; full visual control of the gate, the landing, the report list.

// 04

No client cross-visibility

Each client logs in to their own world. They never see other clients exist.

// 05

Append-only by convention

Reports accumulate; you don't delete prior weeks. The history is the value.

// 06

Sane key rotation

Rotate a client's access key without invalidating their archive — re-encrypt and notify.

003 — Built for

The operators we built this with, not just for.

A module joins the catalog only after the same shape has been built three times for three different operators. Here's who those were.

Boutique agencies

Five to fifty clients. Reporting that looks bespoke without the bespoke build cost.

Fractional CFOs

Multiple operating businesses, one weekly report each, all gated separately.

Operations consultants

Deliver reports to your clients without making them log into a third-party SaaS.

004 — Operating notes

The honest answers we get asked first.

If you have a question that isn't here, that's also fine — bring it to the call.

Where does it host?

Your static host of choice — GitHub Pages, S3 + CloudFront, Cloudflare Pages. Nothing routes through us.

What's the crypto, exactly?

PBKDF2 with 200,000 SHA-256 iterations to derive the key, AES-GCM for the payload. Standard primitives, in-browser via SubtleCrypto.

How are reports updated?

Each report is a separate encrypted file. The client manifest is updated by a small CLI we ship with Atlas. Idempotent, version-aware.

Can I migrate existing clients in?

Yes — Atlas accepts a clients.json import in the WildBreeze format. If your current portal is one of the common ones, we'll write the importer.

Tell us what you're maintaining at 11pm. We'll tell you which module fits.

A 30-minute call. No deck, no demo — just the work. If Atlas is the right shape, we'll say so. If not, we'll point at one that is.

Book a call