Breach Notification Policy
Effective October 22, 2026
Last updated: 22 October 2026
This policy says how we will tell you if a breach affects your data. It rests on the founders acting promptly, because a written incident response plan is not yet in place.
What counts
A breach is a security incident that leads to the accidental or unlawful loss, alteration, disclosure of or access to personal data we hold.
How we find out
Through a report to security@cerqular.ai, through error monitoring on the production application, through the audit log of privileged staff actions, or through a report from a processor.
- An audit log of privileged actions by our staff. Each privileged admin action records one row (who, what and when), and the owner reads the log behind a permission. The write is best effort: it never blocks a request.
- Responsible disclosure: anyone who finds a vulnerability can write to security@cerqular.ai.
Who we tell and when
- Affected members: without undue delay, by email or in the product, saying what happened, which data was affected, what we have done and what you can do.
- Authorities: where the law requires it we notify the relevant authority within the period the law sets. For example, where the GDPR applies that period is 72 hours from becoming aware of a breach that is likely to put people at risk.
- Processors and partners: where a connected service is affected we tell the service so that keys can be revoked.
What we do about it
- Contain the cause, for example by revoking a stored connection key or disabling an affected feature.
- Work out which accounts and which data were affected.
- Fix the cause and write down what changed.
Not yet in place
- A written incident response plan: not yet in place.
- A Data Protection Officer: not yet in place.
Contact
Write to security@cerqular.ai for anything on this page. For personal data requests write to privacy@cerqular.ai.
Status of this text
Counsel review of this policy has not been completed. It states what the code and the infrastructure do today, and where a control is not yet in place it says so.