By default, for security reasons, browsers enforce a same origin policy where javascript can only access data from the same site (domain) that it is hosted on.  In InstantAtlas Online apps this causes issues as the code is hosted on online.instantlas.com but the data can come from ArcGIS Online, any other ArcGIS map servers or csv files.  Modern browsers now support CORS which is a specification that enables data access across different domains.

ArcGIS Online servers already have CORS enabled on them but your own ArcGIS Servers or other ones may not. It is a simple process to do this on your own server as described on enable-cors.org.  GeoWise has built a useful CORS testing tool which will tell you whether a particular web server already has CORS enabled on it.

Note that Internet Explorer 9 does not support CORS.  If your end users are going to be using this browser you will need to get GeoWise to register the map services you want to use with our proxy service.