Compliance

Atellier is built to help you meet the regulatory requirements that matter to your business. This page summarizes our posture; the binding details are in the linked legal documents.

Compliance Posture

• SOC 2 Type II — controls operating; formal audit on roadmap.
• ISO 27001 — control framework aligned; certification on roadmap.
• PCI DSS — Atellier is out of scope. Card data is handled directly by Stripe (a Level 1 PCI Service Provider) and never reaches our servers.
• HIPAA — Atellier is not a HIPAA Business Associate. The Service must not be used to store, process, or transmit Protected Health Information.
• FERPA — Atellier is not designed for educational records covered by FERPA and is not offered as a "school official" service provider.
• GDPR / UK GDPR / Swiss FADP — see the GDPR page and DPA.

GDPR & UK GDPR

For users and customers in the EEA, UK, and Switzerland, we comply with GDPR / UK GDPR / Swiss FADP including lawful bases, data subject rights, and EU SCCs / UK IDTA for international transfers. See our GDPR page and DPA.

CAN-SPAM, TCPA & CASL

All email and SMS sent through Atellier must comply with applicable communications laws. Customers are the senders and are responsible for opt-in records and 10DLC registration. See our Anti-Spam Policy.

U.S. State Privacy Laws

We comply with CCPA/CPRA (California), CPA (Colorado), VCDPA (Virginia), CTDPA (Connecticut), TDPSA (Texas), UCPA (Utah), and similar state laws. We do not sell or share personal information for cross- context behavioral advertising and we honor Global Privacy Control signals. See our Privacy Policy.

EU AI Act

If you publish AI-generated content created with the Service to recipients in the EU, you are responsible for the transparency obligations under EU AI Act Article 50. Our AI Features Addendum documents the AI providers we use, our no-training commitment, and prohibited AI uses.

Data Processing

When Customers use Atellier to manage their customer relationships, Atellier acts as a Processor; the Customer remains the Controller. Our DPA — Article 28-compliant, with EU SCCs and UK IDTA addenda — is available to view and download.

International Data Transfers

Our infrastructure is hosted in the United States. Transfers from outside the US use Standard Contractual Clauses where required, supported by transfer impact assessments and supplementary measures (encryption in transit and at rest, RLS, access controls).

Audit Trail

Atellier maintains comprehensive audit logs for key actions within your organization, including login events, data modifications, permission changes, and administrative actions. Logs are available to organization administrators and exportable for your own compliance needs.

Contact

For compliance inquiries or to request a Data Processing Agreement, contact hello@meonneon.com.

Worldwide Signage Ltd. d/b/a Atellier
8405 W 54th Place
Arvada, Colorado 80002
United States