A national financial institution needed customers to find the nearest branch, ATM, or agent with data that's always right, and a team that could keep it current without relying on third parties or opening a door to security risk. Andes Development built a multi-tenant platform that manages thousands of locations and publishes them as indexable public maps, embeddable maps, and a REST API, run from an admin panel protected by mandatory two-factor authentication, an IP firewall, and a full audit trail.
// The challenge
A large physical network changes every day, and every change has to reach everywhere customers look for it. For a bank, every screen that publishes data is also a surface its security team will review. The key challenges were:
- Thousands of points, one right answer Branches, ATMs inside branches, hours, holiday hours, and services change constantly, and stale data sends customers to a locked door.
- One map, many destinations The same data had to live on a public page, inside the bank's site and app, and in other systems through an API.
- A map that never goes blank The bank wanted Google Maps, without an expired key or a provider outage leaving its customers with no map at all.
- Security that holds up to the bank's review Panel access, file uploads, exports, and API keys all had to meet what a regulated institution's security team expects.
- Measure without tracking The bank wanted to know what customers look for, with no cookies and no personal data.
// The technology solution
Andes Development built a single source of truth with several publishing surfaces, each with its own security layer:
- A modern stack Laravel 13, Filament 5, Livewire 4, MapLibre GL, and Sanctum for the API, with a VitePress help center.
- Five surfaces, one source Admin panel, indexable public map, embeddable map, documented REST API, and help center, all fed by the same data.
- Hierarchical, filterable locations An ATM can live inside a branch; each workspace defines its own filters, phone numbers, links, holiday hours, galleries, and Google Business Profile-style update posts, with two-way Excel import and export.
- A map engine per workspace The bank runs Google Maps with its own encrypted key. If the provider fails or doesn't draw within 8 seconds, the visitor drops to the self-hosted basemap, built from open data and served by the platform, and the failure is logged in the panel. Only the code for the engine in use is downloaded.
- A locked-down admin panel Mandatory two-factor authentication for everyone, passkeys, approved email domains, an IP and network-range firewall that blocks and logs outside attempts, and no password fields at all: each user sets a password from a single-use link sent by email. Platform admin rights can only be granted from the server's terminal.
- Strict authorization A required access policy for every model, child records included; every custom action checks its own permissions, and members can only grant roles they already hold.
- Stateless public surfaces The map and public pages open no session and set no cookies. The API and embeddable maps enforce their own Content Security Policy (CSP), and embeds only load with a signed token on authorized domains. API keys are scoped and IP- and domain-restricted, and their docs open from a signed link that expires after 7 days.
- Data that can't be turned into an attack Only raster images are accepted, SVG icons pass through an allowlist sanitizer, and exports are queued, delivered by signed link, and protected against spreadsheet formula injection.
- Audit and monitoring A timeline audit log on every business, configuration, and access model. Errors go to Sentry and performance data to Nightwatch, both with personal data stripped, plus uptime checks every 5 minutes and an alert if the nightly update doesn't run.
- Code discipline 449 automated tests, Larastan static analysis at level 5, and local Semgrep, gitleaks, and dependency audits before every push; any dependency exception needs an expiration date and a written record.
- Accessible and bilingual Combobox search, focus-trapped dialogs, WCAG AA contrast, and support for reduced motion. The panel, emails, and help center work in Spanish and English, per user.
- Cookieless analytics and local SEO Approximate geolocation that discards the IP, hourly and daily rollups on a nine-widget dashboard, LocalBusiness structured data per location, a sitemap, and llms.txt.
// Results and key wins
Before expanding use of the platform, Andes Development ran an internal audit of the entire codebase that led to 10 remediation releases, and the client's security team scanned the production server:
-
0 findings
At the application level in the external scan by the client's security team; the server infrastructure findings have been resolved or are in progress. -
449 tests
Automated, including checks that no workspace can see another's data. -
2.1 MB lighter
HTML on the map pages, alongside windowed lists that cut about 12 seconds of reads for every 200 lookups on large maps.
A full country basemap builds in about 8 seconds on the production server, extracting only that region from a planet file of about 135 GB without downloading it. One honest caveat: the Content Security Policy on the admin panel and public map still runs in report-only mode, which flags violations without blocking them; on the API and embeds it's already enforced.
// The bottom line
The bank now has a single source of truth for its physical network, published where customers look for it and measured without tracking anyone. Its team updates hours and locations without touching code, the map keeps working even when the provider fails, and every panel sign-in goes through two-factor authentication, a firewall, and an audit log. The platform is ready to add new countries and new clients on the same foundation.