Security, in plain English.

The database and file storage run on Supabase, hosted in the United States, and media is delivered over Bunny’s CDN. Both hold SOC 2 for the layers they operate. Data is encrypted in transit with TLS and encrypted at rest by the storage layer.

Every agency’s data is isolated at the database layer with row-level security, not just application code. The isolation rules are verified by an automated cross-tenant test suite that runs on every change: it signs in as one agency and attempts to read another’s data, and a single leaked row fails the build. We treat any cross-tenant read as a release blocker, always.

Your clients authenticate with magic links sent to their email, so there are no client passwords to phish or reuse. Your team signs in with their own accounts, and workspace access is scoped per client: a client can only ever see their own workspace.

E-signature requests capture disclosure and consent before signing. Every step of a signing session lands in a tamper-evident audit trail with timestamps, and the completion certificate carries the document’s cryptographic fingerprint. That means an executed contract can be verified against its certificate on its own, without asking us.

Destructive actions in the product archive rather than erase, so a mistaken click cannot destroy a client relationship’s history. When you genuinely want data gone, export first, then ask and we will remove it.

We do not hold a SOC 2 or ISO 27001 certificate today. We are a small company and we would rather tell you that plainly than imply otherwise with a wall of badges. Our infrastructure providers do hold those certifications for the layers they operate, and a formal audit of our own is on the roadmap as the customer base grows.

You can export everything you have stored with us: threads as readable transcripts, files in their folders, signed PDFs with their certificates. Our terms commit us to source escrow, so if Client Atrium ever shuts down, customers receive a self-hostable build.

If you believe you have found a security issue, email security@clientatrium.com. A person reads that inbox, and we will respond quickly, credit you if you want credit, and not pursue legal action against research conducted in good faith.