Compliance & Trust
Data Residency
Data Controller
Attomus Limited is the data controller for SemaFore under UK GDPR.
Organisation Details
- Legal Name: Attomus Limited
- Registered in: England and Wales
- Company Number: 06517654
- Address: 23 Berkeley Square, Mayfair, London W1J 6HE
- Contact: hello@attomus.com
- ICO Registration: ZA718457
Core residency position
SemaFore is built so that personal data stays inside the Attomus boundary except for a small number of narrow delivery and payments functions.
Our server infrastructure runs from Attomus-operated facilities in Coventry, United Kingdom. The databases that hold account information, organisation membership, audit events, and encrypted message ciphertext are operated under Attomus control in the UK.
What stays inside the Attomus boundary
- account identifiers such as phone number and display name
- organisation and membership records
- audit log entries
- encrypted message ciphertext
- encrypted file ciphertext
Message content is encrypted on-device using the Signal Protocol before transmission. The server stores ciphertext only and has no mechanism to read message content.
Narrow exceptions outside the Attomus boundary
Three narrow technical exceptions exist:
| Service | Role | Data processed |
|---|---|---|
| Apple APNs | iOS push delivery | Device push token and routing identifiers only; no decrypted message content |
| Google Firebase Cloud Messaging | Android push delivery | Device push token and routing identifiers only; no decrypted message content |
| Twilio | SMS OTP delivery | Phone number and OTP SMS body for sign-in delivery |
| Stripe | Paid-plan billing | Billing identity and payment data for paid organisations |
| Cloudflare edge | TLS termination and DDoS protection | Network metadata such as IP address, request path, timestamp, and status code |
| Cloudflare R2 | Encrypted file blob storage | Opaque encrypted file blobs only |
Outside these functions, personal data does not leave the United Kingdom and does not leave Attomus.
Email and analytics
SemaFore does not currently send transactional emails, and SemaFore does not use third-party advertising, behavioural tracking, or data-broker services.
Privacy Policy and Data Rights
- Privacy Policy: https://semafore.io/privacy
- Data Subject Rights: Contact hello@attomus.com with subject line “Data Rights — SemaFore” to request access, rectification, erasure, restriction, portability, or objection. Attomus will respond within 30 days.
- ICO Complaints: Users may lodge complaints with the Information Commissioner’s Office at ico.org.uk.