Atlas on your website
Atlas is a personal assistant from Teleperson. Sometimes the person it works for asks it to do something on your site, like find a plan, check an order or start a return. Here is exactly how it behaves, and how to recognize it.
The rules
Eight rules Atlas follows on every site
They’re built into the product and hold for every member and every plan. They may get stricter; they never get looser quietly.
Rule 1: No solving person checks
When your site shows a CAPTCHA, an “are you a person?” check or a bot challenge, Atlas stops and hands that step to the person, or offers to call you instead. It never tries to solve a check or pays a service to solve it.
Rule 2: No getting around a block
Atlas doesn't retry from somewhere else. No proxies, no VPNs, no rotating IP addresses, no residential proxy networks. It connects from the person's own Mac and internet connection.
Rule 3: No disguise
Atlas doesn't fake its browser fingerprint or user agent to look like someone or something else. It signs the pages it loads, so you can check that it's Atlas.
Rule 4: The person is there
Atlas works your site only for a goal the person gave it, in their own Atlas app, while they can see the page. Any click or key press from the person takes over.
Rule 5: Some steps are always the person's
Atlas never types passwords, one-time codes or payment details, and never pays, buys, subscribes, moves money or files a dispute. Before any other click that changes something for good, it asks the person first.
Rule 6: Polite pace
One person, one page at a time, at about the speed a person would go. No crawling, no scraping beyond the page in front of it, no parallel sessions.
Rule 7: A “no” gets a person, a call, and a conversation
If your site blocks Atlas, the person takes over or Atlas calls your customer service line instead. Atlas tells us your site blocked it (the site, the kind of block and the day, nothing about the person), and we may get in touch to talk about letting it in.
Rule 8: Nothing about the person in the signature
A signature never carries the person's name, account or anything about them. Each Mac's signing key changes every day, and pages people browse on their own are never signed.
Recognize Atlas
Every page Atlas loads is signed
While Atlas works a page for someone, each page it loads carries an HTTP Message Signature (RFC 9421) in the Web Bot Auth format, signed with Ed25519. Bot-management services that support Web Bot Auth can verify them; if yours does, allow the agent identified by https://teleperson.com.
Signature-Agent: "https://teleperson.com"
Signature-Input: sig1=("@authority" "signature-agent");created=…;
keyid="<key thumbprint>";alg="ed25519";expires=…;nonce="…";tag="web-bot-auth"
Signature: sig1=:<base64 signature>:- Keys: teleperson.com/.well-known/http-message-signatures-directory lists Atlas’s current public keys. keyid is the key’s RFC 7638 thumbprint. The directory itself is signed with Teleperson’s own key, listed first, so no one else can copy it and claim to be Atlas.
- What’s signed: your site’s address (@authority) and the Signature-Agent header. A signature is valid for 60 seconds and carries a fresh random nonce.
- One key per Mac, changed daily: each Atlas install makes its own key and its private half never leaves that Mac. Keys are listed for 48 hours, so you can verify Atlas without being able to follow anyone from day to day.
- Only when Atlas is working: pages people browse themselves in Atlas, and anything outside Atlas, are never signed. Signing starts with Atlas 2.2.72, and members can turn it off.
Your choice
Let Atlas in, or connect directly
Allow verified Atlas. The person Atlas is working for is your customer. Letting a signed Atlas through means they get help from your website instead of waiting on your phone line.
Or skip the browser entirely. With the Teleperson Protocol (TPP), your policies and service actions are available to Atlas directly, inside your own rules, with your customer approving anything that matters. No page loads, no hold queue.
Prefer Atlas stays out? That’s your call. If your site blocks Atlas, it hands the task back to the person or calls your customer service line. It won’t try to get around the block.
Contact
Talk to the team behind Atlas
To allow Atlas, connect through TPP, or tell us something Atlas did on your site that it shouldn’t have, write to security@teleperson.com or book a time with us.