Incident Response Policy
Effective October 22, 2026
Last updated: 22 October 2026
A written incident response plan is not yet in place. This page states how we act today so that you know what to expect.
What exists today
We do not have a written incident response plan, a rehearsed runbook or an on-call rota. What we have is the founders, error monitoring on the production application, and the audit log of privileged staff actions.
- A written incident response plan: not yet in place.
- An audit log of privileged actions by our staff. Each privileged admin action records one row (who, what and when), and the owner reads the log behind a permission. The write is best effort: it never blocks a request.
- Responsible disclosure: anyone who finds a vulnerability can write to security@cerqular.ai.
How we act when something goes wrong
- Report: a report from a member, a researcher or our own monitoring reaches the founders. Security reports go to security@cerqular.ai.
- Contain: we stop the cause first, for example by revoking a connection key or disabling an affected feature.
- Assess: we work out which accounts and which data were affected, using the audit log and application logs.
- Tell: if personal data is affected we notify the people and the authorities as the law requires. See the breach notification policy.
- Fix and learn: we correct the cause and write down what changed.
Communication
We promise honest and prompt communication when an incident affects you. We do not publish an uptime percentage we have not earned.
What we will build
A written incident response plan is the next step. This page will change when it exists, and the line above that says it is not yet in place will be removed only then.
Incident lead
Incident lead: Co-Founder and Co-CEO. Contact: security@cerqular.ai.
Contact
Write to security@cerqular.ai for anything on this page. For personal data requests write to privacy@cerqular.ai.
Status of this text
Counsel review of this policy has not been completed. It states what the code and the infrastructure do today, and where a control is not yet in place it says so.