Information Security Policy
Effective October 22, 2026
Last updated: 22 October 2026
This policy says what we protect, how we protect it today, and what we have not built yet. We would rather be plain about the gaps than imply a control we do not run.
Scope
This policy covers the Cerqular Intelligence platform at cerqular.ai, its backend API, and the data held on it: account data, the business data you connect, the content you create, and the connection keys that let us read the services you authorize.
Cerqular Inc. is an early-stage company. The founders are responsible for security. There is no separate security team yet.
Controls in place today
These are the controls we run now. Each can be checked in the product or in our code and infrastructure.
- Row-level security in the database, so each account can read only its own rows. Your browser never queries the database; every read runs through our API, scoped to the signed-in account.
- TLS encryption for data in transit between your browser, our application and our API.
- AES-256-GCM encryption on the connection keys we store for the services you connect (for example Stripe), so a stored key is not readable as plain text.
- An audit log of privileged actions by our staff. Each privileged admin action records one row (who, what and when), and the owner reads the log behind a permission. The write is best effort: it never blocks a request.
- Multi-factor authentication is enforced on staff accounts that access production systems.
- Daily scheduled malware scans are in place on founder devices.
- Responsible disclosure: anyone who finds a vulnerability can write to security@cerqular.ai.
Controls not yet in place
We list these so that nobody has to guess. When one of them is built we will move it to the list above.
- Formal third-party security certifications (for example SOC 2 or ISO 27001): not yet in place. We hold none.
- A written incident response plan: not yet in place.
- A Data Protection Officer: not yet in place.
Principles we work to
- We read only the data you authorize when you connect a service, and nothing more.
- We do not sell personal data and we do not share it for third-party advertising.
- Your content and connected business data are not used to train third-party foundation models.
- Every revenue figure we show carries an honest Measured, Reported, Estimated or Modeled label.
Related policies
Access control, endpoint protection, incident response, data classification, vulnerability management, data protection and breach notification each have their own page, listed on the policies index at /policies. The plain-English summary of our posture is on the Trust page.
Review and contact
The founders review this policy when something material changes. There is no fixed review schedule yet. Counsel review is a separate step that has not been completed. Write to security@cerqular.ai for anything on this page. For personal data requests write to privacy@cerqular.ai.
Status of this text
Counsel review of this policy has not been completed. It states what the code and the infrastructure do today, and where a control is not yet in place it says so.