Security, in plain English.

The database and file storage run on Supabase, hosted in the United States, and media is delivered over Bunny’s CDN in the European Union. Each publishes its own compliance documentation for the layers it operates. Data is encrypted in transit with TLS and encrypted at rest by the storage layer. The privacy policy names every subprocessor and what each one holds.

Every agency’s data is isolated at the database layer with row-level security, not just application code. The isolation rules are verified by an automated cross-tenant test suite that we run before every release: it signs in as one agency and attempts to read another’s data. A single leaked row is a release blocker, always.

You invite a client by email, and they set their own password on first visit. Sessions are cookie-based and expire. Access is scoped per workspace: a client user can only ever reach the workspace they were invited to, enforced at the database layer rather than by the screens they are shown.

E-signature requests capture disclosure and consent before signing. Every step of a signing session lands in a tamper-evident audit trail with timestamps, and the completion certificate carries the document’s cryptographic fingerprint. Any copy of the document can be checked against that fingerprint and the audit record to prove nothing changed after signing.

Destructive actions in the product archive rather than erase, so a mistaken click cannot destroy a client relationship’s history. When you genuinely want data gone, an admin erases the client workspace from its manage page: messages, files and their stored bytes, projects, decisions, and invoices are destroyed in one operation, along with the sign-in identities of people who existed only there. You type the workspace name to confirm, it is recorded in the audit log, and it cannot be undone, so export first if you want a copy. Erased data leaves encrypted backups as those cycle, within 90 days. Signed agreements and their audit trails are the exception: electronic-signature law expects executed records to persist, so where a workspace holds them it is emptied and kept as a record of those agreements rather than removed.

We do not hold a SOC 2 or ISO 27001 certificate today. We are a small company and we would rather tell you that plainly than imply otherwise with a wall of badges. Our infrastructure providers publish their own compliance documentation for the layers they operate, and a formal audit of our own is on the roadmap as the customer base grows.

Any admin can export a workspace in one click and get a zip: conversations as readable Markdown transcripts with the same records as JSON beside them, every uploaded file with a manifest, signed documents as PDFs with their certificate pages and full signature log, plus projects, decisions, people, and invoices. Nothing in it needs our software to open. Direct messages and private channels the exporter cannot already open are not included, and very large file libraries continue as download links in the manifest. Our terms also commit us to source escrow, so if Client Atrium ever shuts down, customers in good standing receive a self-hostable build.

If you reached this page from a portal your agency runs, the agency controls that workspace and we hold the data for them. What the badge means explains who to ask for what, and how to reach us directly if your agency is not the right answer.

If you believe you have found a security issue, email security@clientatrium.com. A person reads that inbox, and we will respond quickly, credit you if you want credit, and not pursue legal action against research conducted in good faith.