Data Classification Policy
Effective October 22, 2026
Last updated: 22 October 2026
We sort the data we hold into four classes, and handle each class with the controls that run today.
Public
What we publish on cerqular.ai: marketing pages, guides, blog posts and these policies. No restriction on reading it.
Internal
Company material that is not published: plans, drafts and internal notes. Shared only with the founders and the people they authorize.
Confidential
Member data: account details, the business data a member connects, and the content a member creates.
- Row-level security in the database, so each account can read only its own rows. Your browser never queries the database; every read runs through our API, scoped to the signed-in account.
- TLS encryption for data in transit between your browser, our application and our API.
- We do not sell it, and we do not use it for third-party advertising or to train third-party foundation models.
Restricted
The secrets that open other systems: the connection keys we store for connected services, and our own service credentials.
- AES-256-GCM encryption on the connection keys we store for the services you connect (for example Stripe), so a stored key is not readable as plain text.
- An audit log of privileged actions by our staff. Each privileged admin action records one row (who, what and when), and the owner reads the log behind a permission. The write is best effort: it never blocks a request.
- Restricted data is never printed to logs or shown in the product.
Not yet in place
Data is not yet labelled by class inside our systems, and there is no automated tooling that tags or enforces classes. The classes above describe how we decide and how we handle; they are not yet a technical control of their own.
Questions
Write to security@cerqular.ai for anything on this page. For personal data requests write to privacy@cerqular.ai.
Status of this text
Counsel review of this policy has not been completed. It states what the code and the infrastructure do today, and where a control is not yet in place it says so.