Trust
How the site is run, what protects it, what the agents do and what a person checks. Statuses are facts about today (2026-10-20); planned items say planned. Live checks and uptime: /status/.
Security headers
| Header | Value | Where it is set |
|---|---|---|
| Strict-Transport-Security | max-age=31536000 | CloudFront response headers policy |
| Content-Security-Policy | self + named hosts for scripts, styles, fonts, images, frames and analytics; see the live header | CloudFront response headers policy (report-only first, enforced once the test showed no violations) |
| X-Content-Type-Options | nosniff | CloudFront |
| X-Frame-Options | SAMEORIGIN | CloudFront |
| Referrer-Policy | strict-origin-when-cross-origin | CloudFront |
| Permissions-Policy | camera, microphone, geolocation, payment, usb off | CloudFront |
| X-XSS-Protection | 1; mode=block (legacy) | CloudFront |
Check them yourself: curl -sI https://retrofitatlas.org/. Vulnerability reports: security.txt (contact desk@retrofitatlas.org).
Data handling
- No passwords, no payment data. API accounts are passwordless: a magic link by email issues a key and a 30-day session; we store the email, a hash of the key, tier and usage counts. Forms are mailto links; what you send sits in the desk mailbox.
- Analytics only with consent in Europe and for Global Privacy Control users; one first-party consent cookie. Privacy.
- Public data about places and organisations. Owner names from county assessors and filings; natural persons withheld; removal requests answered within five working days.
- The raw working database is not public; the published SQLite, CSV and GeoJSON are exports of the public fields only, and the bulk files answer only with an access cookie in the academic phase.
- AI crawlers may read the public pages and the LLM summaries (llms.txt), the same as search engines; nothing can write to the database from outside (forms are mailto, the API and MCP server are read-only, every change goes through a person). The authors' raw sheet is never served.
- No book text. The sources are the authors' public 2021 web map and public web pages; an audit of the source table and the extraction prompts on 20 Oct 2026 found no text from Retrofitting Suburbia or Case Studies in Retrofitting Suburbia (0 book-kind rows, no Wiley or ISBN URLs; provenance counts).
- Backups: the database is copied to a private Google Drive folder before edits and a dated release is kept under /data/releases/ on each publish.
Refresh cadence
The site is regenerated and published by deploy.sh after each batch of changes (several times a day during the build-out, 20 Oct 2026). A nightly scheduled publish is planned, not yet running. A news watcher runs every six hours and files candidate changes for review; nothing it finds goes live without a person. Each publish writes a release and a changelog entry.
What the agents do and what a person reviews
| Step | Who | Review |
|---|---|---|
| Import sites from the authors' public map, Wikipedia, Wikidata, Esri, public records | scripts | tier label only; the authors have not reviewed the records |
| Extract before/after facts from sources with a quoted sentence | language models (open-weight and hosted), labelled per field | stays 'Imported, unreviewed' until a person reads it; documented chip shows the quote |
| Parcels, assessments, EDGAR filings, context layers | scripts against public APIs | automated; source and retrieval date on the record |
| Promote a record, change a tier, remove a name | a person (Hadi Irvani) | logged in change_log with who and when |
| Outreach, replies, licences | drafted by agents | sent only by a person; nothing automated leaves the desk |
Sub-processors and third parties
| Service | Used for | What they see |
|---|---|---|
| Amazon Web Services (S3, CloudFront, Lambda, API Gateway, Route 53) | hosting, CDN, API, DNS | us-east-1; access logs |
| Google Fonts | Fraunces and Geist Mono font files | font requests carry your IP to Google |
| Fontshare (Indian Type Foundry) | General Sans font files | font requests carry your IP |
| Google Analytics 4 | visit counts; Google signals off | behind the consent bar; declined = never loads |
| Microsoft Clarity | session replays and heatmaps, text masked | behind the consent bar |
| Cloudflare cdnjs | the d3 library on the network map pages | script request carries your IP |
| OpenStreetMap Foundation | map tiles and embedded map frames | tile requests carry your IP |
| Stalwart mail (self-hosted) and Google Workspace | desk@retrofitatlas.org mailbox | what you email us |
Not in place yet
- No SOC 2 or other certification; a one-person project.
- No signed data licence with the authors (in discussion).
- Status page: /status/ runs five checks every five minutes with 24 h / 7 d / 30 d uptime (API session, 20 Oct 2026).
- No bug bounty; good-faith reports welcomed at the security.txt address.
- API keys and quotas exist (docs); usage logs are not yet published.
Page generated with the site, release 2026-10-20. Corrections: the form or desk@retrofitatlas.org.