Privacy and Data Protection
ATLAS MDM should be operated with privacy laws in mind, including PIPEDA for Canada and applicable U.S. privacy, consumer protection, and cybersecurity requirements. If you serve customers in other regions, review GDPR, state privacy laws, telecom rules, and any sector-specific requirements.
- Publish a clear privacy policy before collecting customer or device data.
- Collect only the information needed for account access, device management, support, security, billing, and compliance.
- Use access controls so resellers and sub resellers see only their permitted hierarchy.
- Define retention periods for account records, device logs, APK scan results, credit ledgers, support tickets, and security incidents.
Remote Support Consent
Remote support is a sensitive workflow because it can reveal screen content and allow keyboard or mouse control. The safer default is attended support only: the client device must show a notification and the user must tap Allow before a session starts.
- Show clear Allow and Deny choices on the device.
- Display an active-session indicator while mirroring or control is running.
- Stop immediately when the client denies, revokes consent, disconnects, or when a security anomaly is detected.
- Log the actor, device, consent decision, start time, end time, route, and support actions.
APK Safety and Software Distribution
Every APK upload should be treated as untrusted until verified. Production systems should quarantine files, scan with antivirus, parse Android metadata, validate package and certificate information, and block risky or malicious packages before deployment.
- Reject malware, spyware, stalkerware, credential theft, ransomware, fraud tools, and unauthorized surveillance applications.
- Record file hash, upload owner, package name, version, signing certificate summary, scan result, and assignment scope.
- Notify the uploader and responsible parent account when an APK or support attachment is rejected.
Security Framework
The browser panel is only the user interface. Real security must be enforced by the backend. Production deployment should include MFA for Admin, short-lived tokens, server-side role checks, encrypted storage, TLS 1.3, Android certificate pinning, command signing, replay protection, upload scanning, and immutable audit logs.
Incident Response and Abuse Handling
If the platform or agent detects scam activity, harassment, coercion, unauthorized access, credential theft, malware distribution, consent bypass attempts, or other illegal activity, the system should suspend the remote session, block the offending account, create an admin-visible flag, notify the parent account, and open a support ticket for review.
Suspension should be scoped to the offending account only unless a separate account creates its own violation. Admin should retain the reason, source, evidence summary, device ID, timestamp, and resolution notes.
Launch Readiness
- Replace placeholder company details on every legal page.
- Have attorney-reviewed Privacy, Terms, Refund, and compliance pages.
- Publish reseller agreements and support consent language.
- Document billing, refunds, chargebacks, credit pullbacks, and payment confirmation rules.
- Define backup, monitoring, disaster recovery, breach notification, and account recovery procedures.