An email signature looks harmless, but the service that manages it reads your organization's directory and runs inside Outlook, on every message sent. This page explains, without marketing jargon, how ATOM Signatures protects your data: where it is hosted, how client organizations are kept apart, what is retained and for how long, and which vendors we rely on. Each point below matches what the product actually does today.
Where is your data hosted?
The service's infrastructure — application servers, database and uploaded files (logos, for example) — is operated directly by ATOM Solutions, in Quebec. It is not an outside host: we do not entrust your configuration data to a foreign cloud provider.
- Database and files: on our own infrastructure, in Quebec.
- Backups: encrypted before leaving our servers, then stored in Canada, in Toronto (Ontario).
- Traffic: it passes through a Cloudflare tunnel. Cloudflare terminates TLS encryption and therefore sees traffic in transit, without storing it. All communications are encrypted (TLS) and the service enforces HTTPS.
The only processing that may leave Canada is that of named subprocessors for specific functions (payment, audience measurement): see the Subprocessors section. For the broader picture, read our guide to Canadian data hosting.
Isolation between organizations
ATOM Signatures is a service shared by several organizations. Each one is identified by its Microsoft 365 tenant, and all the data that belongs to it — signatures, assignments, logos, branding, preferences — carries that organization's identifier.
Isolation does not rely on application code alone. It is enforced by the database itself, through PostgreSQL row-level security, forced on these tables: a query made on behalf of one organization can neither read nor write another's rows, even if a programming defect tried to. With no organization identified, the database returns no rows.
This guarantee is checked by automated tests that replay attempts by one organization to reach another's data.
Does email pass through ATOM's servers?
ATOM Signatures is not a mail relay. There is no outbound connector and no Exchange transport rule: the signature is inserted by an Outlook add-in, inside the employee's own application, while the message is being written. The email then follows its normal path through Microsoft 365.
- Message content: we neither read nor keep the body or subject of your emails.
- What the add-in sends: the sender's address and, where applicable, the shared mailbox address, to choose the applicable signature and count the licenses in use, plus the platform used (desktop, web, mobile). When a message is sent, with Outlook on desktop or on the web, it also sends only the domains of the recipients (never their addresses or names), to choose between an internal and an external signature; these domains are neither stored nor logged.
- Directory access: read-only, limited to users and groups, after an administrator's consent. The service requests no permission to access mailbox content.
Why this matters: a service that routes every message sees the content of all your emails. See routing-free architecture for the full comparison.
Authentication and access
- Microsoft Entra (SSO): console access goes through the administrator's Microsoft sign-in. ATOM manages and stores no passwords.
- Restricted access: the console is restricted to Microsoft 365 administrators, or people they explicitly authorize, of an activated organization.
- "My signature" pane: employees authenticate through Microsoft delegated authentication, with no password of ATOM's own.
- Add-in token: the token that links the Outlook add-in to an organization is stored only in hashed form, never in the clear.
- Session: the console session cookie is protected (not readable by page JavaScript, sent over HTTPS only) and expires after 8 hours.
- Standard protections: security headers (HSTS, content security policy), rate limiting and abuse protections.
Audit log
Sensitive actions are recorded in an append-only audit log: console sign-ins, creation, modification and deletion of signatures, logo uploads, billing changes. Proof of administrator consent is kept separately. Each entry records the actor, the action, the object concerned, the IP address and the timestamp. When an authorized partner (MSP) acts in your console, its actions appear there with the name of its organization.
"Append-only" has a precise meaning: no function of the application modifies or deletes an entry. Only the retention purge removes them; the retention period is set out in our privacy policy.
Law 25 and data retention
For your organization's directory and staff information, your organization remains responsible under the law; ATOM Solutions acts as its mandatary, following your instructions and within the limits needed to provide the service (section 18.3 of Law 25, reflected in section 11 of our terms of use). The person in charge of the protection of personal information can be reached at info@atomsolutions.ca.
Retention is automatic: a schedule built into the application purges expired data, with no manual step.
| Data | Retention |
|---|---|
| Organization data (signatures, configuration, directory attributes, employee preferences) | For the subscription, then automatic deletion 30 days after the cancellation takes effect |
| Signature deleted in the console | Trash for 30 days, then permanent purge |
| Audit log | Period set out in the privacy policy |
| Aggregated click and send statistics | 25 months at most, with no IP address or individual event |
| Billing records | For the periods required by tax laws |
In the event of a privacy incident affecting your organization's information, we notify it without delay and assist with its steps. You can request an export of your data before the end of the subscription. Full details are in our privacy policy; for how the law applies to signatures, see Law 25 applied to email signatures.
This page is provided for information only and is not legal advice.
Data processing agreement (DPA)
The personal-information processing mandate is already set out in section 11 of our terms of use. If your organization also requires a separate data processing agreement (DPA), for its register or a tender for example, we provide one on request: write to info@atomsolutions.ca with your organization's name.
Subprocessors
We neither sell nor rent any personal information. We rely on a limited number of subprocessors, for specific functions. They are bound by contractual confidentiality obligations and may only use the information for the intended purposes.
| Subprocessor | Role | Information involved |
|---|---|---|
| Microsoft (Graph / Entra) | Authentication and directory reads | Accounts, directory attributes |
| Stripe | Payment processing; identity verification and payouts to resellers (Stripe Connect) | Billing contact details, payment data; reseller identity and banking details, collected directly by Stripe |
| Cloudflare | Tunnel connecting our infrastructure to the Internet; TLS encryption; audience and performance measurement of pages, without cookies | Traffic in transit (seen, not stored); anonymous browsing measurements |
| Google LLC (Google Analytics 4) | Audience measurement on public pages, only after consent | Aggregated browsing data (public pages) |
| Microsoft Corporation (Microsoft Advertising) | Measuring the effectiveness of our ads and remarketing, only after consent | Public pages viewed, conversions, advertising cookie identifiers |
| Meta Platforms, Inc. | Measuring the effectiveness of our ads and remarketing, only after consent | Public pages viewed, advertising cookie identifiers |
The privacy policy (section 6) is the reference for this list. Before any communication of information outside Quebec, we assess the privacy factors involved and govern it by contract.
Responsible disclosure
Found a flaw, or behavior that looks like one? Write to us at info@atomsolutions.ca, describing what you observed and how to reproduce it. Our security contact is also published in the standard format (RFC 9116) at /.well-known/security.txt.
- Report the issue to us privately, before any publication, so we have time to fix it.
- Access only your own data, and do not keep any that belongs to another organization.
- Write to us in French or English.
What we do not claim
We do not claim any third-party certification, such as SOC 2 or ISO 27001. The safeguards described here are architecture choices and mechanisms the product applies; they do not replace an independent attestation. If your organization has specific requirements, tell us at info@atomsolutions.ca.
Frequently asked questions
Where is ATOM Signatures data hosted?
The service's infrastructure (servers, database, files) is operated by ATOM Solutions itself, in Quebec. Backups are encrypted before leaving our servers and stored in Canada, in Toronto. Traffic passes through a Cloudflare tunnel, which terminates TLS encryption without storing the content.
Does ATOM Signatures read the content of my emails?
No. The Outlook add-in inserts the signature locally, while the message is being written; email is never routed through our servers. We neither read nor keep the body or subject of messages. The add-in only sends the sender's address and, where applicable, the shared mailbox address, to choose the signature and count licenses. When a message is sent, with Outlook on desktop or on the web, it also sends only the domains of the recipients, to choose between an internal and an external signature; these domains are neither stored nor logged.
How is my organization's data kept separate from other customers' data?
Every piece of data carries the organization's identifier, and isolation is enforced by the database itself through PostgreSQL row-level security. A query made for one organization can neither read nor write another's data. Automated tests check this separation.
What happens to my data if I cancel my subscription?
Your organization's own data is deleted automatically 30 days after the cancellation takes effect. Billing records are kept for the periods required by tax laws. You can request an export of your data before the end of the subscription.
Can you sign a data processing agreement (DPA)?
The processing mandate is set out in section 11 of our terms of use. If your organization requires a separate data processing agreement, we provide one on request: write to info@atomsolutions.ca with your organization's name.
How do I report a security vulnerability?
Write to info@atomsolutions.ca describing what you observed and how to reproduce it. Our security contact is also published in the /.well-known/security.txt file, in the standard RFC 9116 format. Please report the issue to us privately before any publication.
Microsoft 365 signatures that respect your data. ATOM Signatures applies your organization's signature in Outlook, client-side, on infrastructure operated in Quebec and without ever routing your email.
To go further: Canadian data hosting, email data sovereignty and the privacy policy.