Atrium self-hosted data protection addendum

This addendum, effective from 8th October 2026, applies when you host your Atrium app on your own systems, or on systems you choose, rather than on COHO’s infrastructure. It forms part of your Atrium developer agreement with Company For Life Ltd, trading as COHO (“we”, “us”). Words defined in the Developer Agreement mean the same here.

Your app receives customer data from COHO through our API, and processes it on your systems. This addendum sets the minimum standards you must meet to do that. The Atrium standard app data processing agreement sets out your obligations to each customer. This addendum sets out your obligations to us.

You’re responsible for your systems

You’re responsible for the security of every system your app runs on, and for anyone you use to host, run or support it. We don’t host, check or control your systems, and we’re not responsible for what happens to customer data once your app receives it.

You’re not our sub-processor. You process customer data for the customer who installed your app, under the Atrium standard app data processing agreement.

Your privacy policy

You must publish a privacy policy at a stable public web address, linked from your app’s listing, and keep it up to date. As a minimum, it must explain:

  • who you are, and how to contact you about privacy;
  • that you process personal data for the customers who install your app, as their processor, and what you process for your own purposes, such as account and billing data, as a controller;
  • what personal data your app processes, including data received through COHO’s API;
  • why you process it and, where you act as controller, your lawful basis;
  • who you share it with, including your sub-processors, or where to find your sub-processor list;
  • where it’s stored and processed, and the safeguards you use for any processing outside the UK;
  • how long you keep it, including deleting it when a customer uninstalls your app;
  • how you keep it secure, in summary;
  • people’s data protection rights, how to exercise them, and their right to complain to the Information Commissioner’s Office;
  • any cookies or similar technologies your app uses;
  • any automated decision-making or artificial intelligence processing, and confirmation that customer data isn’t used to train models without the customer’s written agreement;
  • when it was last updated.

If your privacy policy stops meeting these requirements, or its link stops working, we may suspend your app until it’s fixed.

Your licence terms

If you use your own licence terms rather than the Atrium standard app licence, they must meet the minimum requirements in the App review & listing guidelines, and must not conflict with the Atrium terms or the Atrium standard app data processing agreement.

Minimum security standards

As a minimum, you must:

  • encrypt customer data in transit, using TLS 1.2 or higher, and at rest;
  • use multi-factor authentication for all administrative and production access, including your hosting, code repository and email accounts;
  • limit access to customer data to the people who need it, review that access at least every six months, and remove it promptly when someone leaves;
  • keep access logs for production systems for at least 12 months;
  • store COHO API tokens and secrets encrypted, in a secrets manager or equivalent, and never in code repositories, in code that runs in a browser or on a device, or in logs;
  • keep customer data separated by customer;
  • apply security patches to your systems and dependencies promptly, and critical patches within 14 days;
  • back up customer data securely, and test that you can restore it;
  • have a written plan for responding to security incidents;
  • for paid apps, or apps that can change customer data, have an independent penetration test at least once a year, and fix serious findings promptly.

You must tell us if you can no longer meet any of these standards.

Where you process data

Your app’s listing must say where you, and your sub-processors, store and process customer data.

If any of it is processed outside the UK, you must have a safeguard recognised under UK law in place, as set out in the Atrium standard app data processing agreement. You’re responsible for assessing whether that safeguard is adequate.

Using only the data you need

Your app must:

  • request only the API permissions it genuinely needs, and explain each one on its listing;
  • store only the customer data it needs, for only as long as it needs it;
  • stop using a customer’s data, and revoke its tokens on your side, as soon as we tell you the customer has uninstalled your app.

Security incidents

If there’s a security incident or personal data breach affecting customer data, you must tell the affected customers, and us at team@coho.life, without undue delay and in any case within 48 hours, as set out in the Atrium developer agreement.

If we believe a COHO API token used by your app has been compromised, we may revoke it immediately.

Evidence and checks

When we ask, you must give us reasonable evidence that you meet this addendum. That could include a completed security questionnaire, a summary of your latest penetration test, or relevant certifications such as Cyber Essentials or ISO 27001.

We may suspend your app if you don’t provide it, or if it shows that you don’t meet this addendum.

When this addendum ends

This addendum ends when the Atrium developer agreement ends, or when you no longer host any Atrium app yourself. Your obligations on security, incidents and deleting customer data continue until all customer data your app received has been deleted.