Compliance & Trust
Data Residency
Data Controller
Attomus Limited is the data controller for Semafore under UK GDPR.
Organisation Details
- Legal Name: Attomus Limited
- Registered in: England and Wales
- Company Number: 06517654
- Address: 23 Berkeley Square, Mayfair, London W1J 6HE
- Contact: hello@attomus.com
- ICO Registration: ZA718457
Data Held and Storage
Message Content Message bodies are end-to-end encrypted on the device using the Signal Protocol (X3DH + Double Ratchet). Encryption occurs before transmission to the server. The Semafore server holds only ciphertext; Attomus has no access to plaintext message content.
User and Device Data The Semafore database stores:
- Phone numbers and device identifiers (for registration and device trust)
- Encrypted identity keys (Signal Protocol key material; decryption keys remain on-device)
- Device metadata (device name, registration timestamp, approval status)
Data Hosting Location
All Semafore server infrastructure — including the MongoDB, PostgreSQL, and Redis data stores — runs on Attomus-owned and operated hardware located in the United Kingdom. Data does not leave UK jurisdiction in the course of normal platform operation. Attomus does not use third-party cloud providers (AWS, Azure, GCP, or similar) for data storage or processing. The server estate is maintained behind Attomus’s own network boundary and firewall.
This means all personal data processed by the Semafore server remains in the UK and under Attomus’s direct operational control at all times.
External Processors (Delivery Layer Only)
Semafore’s data stores are entirely Attomus-operated. The only external services used are for mobile push notification delivery — the technical mechanism by which a device is woken to retrieve and decrypt a waiting message. These providers do not receive message content.
| Service | Role | Data Processed |
|---|---|---|
| Apple APNs | Push notification delivery (iOS) | Device push token; silent wake-up signal only — no message content |
| Google Firebase Cloud Messaging | Push notification delivery (Android) | Device push token; silent wake-up signal only — no message content |
| Cloudflare | Edge routing and DDoS protection | HTTP request metadata (IP address, request timestamp, HTTP status code); not linked to user identity in routine operation |
Each provider operates under a Data Processing Agreement (DPA) as a processor under UK GDPR Article 28. Push notification payloads carry no message content — they signal the device to reconnect to the Semafore server, where the encrypted message is retrieved and decrypted locally.
Privacy Policy and Data Rights
- Privacy Policy: https://semafore.io/privacy
- Data Subject Rights: Contact hello@attomus.com with subject line “Data Rights — Semafore” to request access, rectification, erasure, restriction, portability, or objection. Attomus will respond within 30 days.
- ICO Complaints: Users may lodge complaints with the Information Commissioner’s Office at ico.org.uk.