Atrium app review & listing guidelines

These guidelines, effective from 8th October 2026, explain what we look for when we review apps for Atrium, the COHO app store, and what every listing must include. They form part of the Atrium developer agreement.

Atrium customers are landlords, letting agents and property managers. They trust apps in Atrium with their tenants’ data and with how they run their business. These guidelines are there to protect that trust.

How review works

Every new app must pass review before it’s published. So must any update that:

  • asks for new or wider permissions;
  • changes how or where the app processes data;
  • changes its price or pricing model;
  • adds in-app purchases;
  • materially changes what the app does.

Other updates can be published without a full review, but we may review any app at any time.

We aim to complete reviews within 10 working days. Complex or high-risk apps can take longer, and we’ll tell you if they will.

Review levels

The depth of our review depends on the app’s risk.

  • Standard – Self-hosted apps with read-only access to data that doesn’t identify people – We review listing, licence terms, permissions
  • Enhanced – Apps with any access to personal data, or that can change data – We review everything above, plus your privacy policy, security and data location
  • Full – Apps we host, apps that can change tenant, financial or payment data, and apps that produce legal or compliance documents – We review everything above, plus testing of the app, a review of its code or security evidence, and your insurance

We may put a new developer’s first app on a probation period, with a limit on how many customers can install it, while we check it works well in practice.

What every listing must include

  • Name and icon. Your own, and not likely to be confused with COHO or another app.
  • Developer. Your business name, and the country you’re based in.
  • Description. What the app does, accurately and without exaggeration, and any limitations.
  • Screenshots. Showing the real app.
  • Type. Whether the app is hosted by COHO or by you.
  • Permissions. Every permission the app asks for, and a plain-English explanation of why it needs each one.
  • Data location. Where the app stores and processes data, including your sub-processors.
  • Privacy policy. A link to your privacy policy, meeting the Atrium self-hosted data protection addendum if you host the app yourself.
  • Sub-processors. A link to your list of sub-processors.
  • Licence terms. A link to your own licence terms, or a statement that the Atrium standard app licence applies.
  • Price. The monthly price and pricing model (flat, per active unit with any minimum, or by unit band with each band’s price), and the length of any free trial, excluding VAT.
  • Support. How customers get support, and when.

Keep your listing up to date. If anything in it stops being true, update it straight away.

Minimum requirements for your own licence terms

If you use your own licence terms rather than the Atrium standard app licence, they must:

  • say who you are and how to contact you;
  • set out what the customer may do with the app, and for how long;
  • say that paid apps, and anything bought inside them, are bought from COHO under the Atrium terms, and not charge the customer directly;
  • describe the support you provide;
  • incorporate the Atrium self-hosted data protection addendum, and say it wins if there’s any conflict about personal data;
  • not limit your liability for breaching that agreement or data protection law;
  • not exclude liability for death or personal injury caused by negligence, or for fraud;
  • explain what happens when the customer stops using the app, including returning or deleting their data, in line with the Atrium self-hosted data protection addendum;
  • allow COHO to enforce them on the customer’s behalf;
  • be governed by the law of England and Wales;
  • include a contact for complaints.

They must not conflict with the Atrium terms, for example on refunds, cancellation or billing.

What apps must do

Your app must:

  • work as described on its listing, reliably, and without serious bugs;
  • request only the permissions it needs, and use data only to provide the app;
  • keep customer data secure, as set out in the Atrium developer agreement and its addenda;
  • handle errors gracefully, and never expose one customer’s data to another;
  • use our billing and entitlements API for anything paid for through Atrium;
  • respect our API rate limits and fair use limits.

What apps must not do

Your app must not:

  • be sold or offered to tenants, residents or anyone else acting outside their business;
  • direct customers to pay you or anyone else outside Atrium, through links, buttons, messages or emails;
  • sell, share or reuse customer data, or use it to train artificial intelligence models, without the customer’s written agreement;
  • scrape COHO, get around any security measure or limit, or access data outside its approved permissions;
  • contain viruses, malware, hidden features, or anything designed to harm customers, their data or COHO;
  • imitate COHO, or suggest that we endorse it beyond listing it;
  • infringe anyone’s intellectual property or other rights;
  • include advertising for third parties without our agreement;
  • break the law, or COHO’s acceptable use policy.

Apps that need our agreement first

Talk to us before you build or submit an app that:

  • carries out any activity regulated by the Financial Conduct Authority, such as payment services, credit, insurance or holding client money;
  • collects or moves money, such as rent, deposits or fees;
  • carries out identity, Right to Rent, UK sanctions, referencing or credit checks;
  • produces tenancy agreements, legal notices or other documents with legal effect;
  • makes automated decisions that significantly affect people, such as approving or rejecting tenants.

We may accept these apps, but we’ll ask for evidence that you’re authorised where needed, that your outputs are accurate and up to date with the law, and that you have the right insurance. Apps that produce legal or compliance documents must make clear what they’re for, and must be kept up to date when the law changes, for example the Renters’ Rights Act.

If we reject your app

If we reject your app or an update, we’ll tell you why and what needs to change. You can fix the issues and resubmit.

If you think we’ve made a mistake, reply to our decision within 30 days explaining why. Someone who wasn’t involved in the original review will look at it again, and we’ll respond within 10 working days.

Removing apps

We may remove or suspend an app at any time for the reasons in the Atrium developer agreement, including if it no longer meets these guidelines. Where we can, we’ll tell you first and give you a chance to put things right.

Changes to these guidelines

We may update these guidelines from time to time. We’ll give you at least 30 days’ notice of any change that affects apps already published, unless it’s needed to comply with the law or to deal with a security risk.