A national financial institution needed customers to find the nearest branch, ATM, or agent with data that's always right, and a team that could keep it current without third parties. Andes Development built a multi-tenant platform that manages 3,600+ locations and publishes them as indexable public maps, maps embedded on other sites, and a REST API, with cookieless analytics and a basemap hosted on its own infrastructure.
// The challenge
A large physical network changes every day, and every change has to reach everywhere customers look for it. The key challenges were:
- Thousands of Points, One Right Answer Branches, ATMs inside branches, hours, holiday hours, and services change constantly, and stale data sends customers to a locked door.
- One Map, Many Destinations The same data had to live on a public page, inside the bank's site and app, and in other systems through an API.
- Maps Without Third-Party Risk Open map data can be altered without notice, and commercial services charge per load.
- Measure Without Tracking The bank wanted to know what customers look for, with no cookies and no personal data.
- Room to Grow The platform had to be ready for new markets and new clients without a rewrite.
// The technology solution
Andes Development built a single source of truth with several publishing surfaces, each with its own security layer:
- A Modern Stack Laravel 13, Filament 5, Livewire 4, and MapLibre GL, with Sanctum for the API.
- Five Surfaces, One Source Admin panel, indexable public map, embeddable map, documented REST API, and help center, all fed by the same data.
- Hierarchical, Filterable Locations An ATM can live inside a branch; each client defines its own filters, holiday hours, galleries, and Google Business Profile-style update posts.
- A Self-Hosted Basemap Vector tiles hosted by the platform and generated from open data, with third-party labels turned off after vandalism was spotted in open map data.
- Security per Surface A separate CSP for each surface, embeds gated by a signed token and a domain allowlist, and API keys that are scoped, IP- and domain-restricted, and stored hashed.
- Strict Access An authorization policy on every model, panel access only with an approved email domain plus a role, two-factor and passkeys, and an audit trail for roles and passwords.
- Cookieless Analytics Approximate geolocation that discards the IP, hourly and daily rollups, and session journeys with inferred intent on a nine-widget dashboard.
- Local SEO LocalBusiness structured data per location, a sitemap and llms.txt, plus two-way Excel import and export with every run audited.
// Results and key wins
The platform publishes the bank's entire network and is ready to grow:
-
3,600+ Locations
Published and maintained by the bank's own team across public maps, embeds, and the API. -
2.1 MB Lighter
HTML on the map pages, alongside windowed lists that removed reads of up to 12 seconds. -
14 s
To build a full country basemap (104 MB) from a 135 GB planet file; adding a second country brings it to 148 MB.
// The bottom line
The bank now has a single source of truth for its physical network, published where customers look for it and measured without tracking anyone. Its team updates hours and locations without touching code, the maps don't depend on pay-per-load services, and the platform is ready to add a second country and new clients on the same foundation.