Vulnerability Management Policy
Effective October 22, 2026
Last updated: 22 October 2026
This policy covers how we receive, handle and close security vulnerabilities, and what we have not built yet.
Reporting a vulnerability
Found a vulnerability? Tell us at security@cerqular.ai. Please give us a reasonable window to fix it before you disclose it publicly.
- Responsible disclosure: anyone who finds a vulnerability can write to security@cerqular.ai.
What we do with a report
- We acknowledge reports quickly and keep the reporter informed while we fix.
- We do not pursue good-faith security research.
- We fix the cause, check the fix, and tell the reporter when it is done.
- If member data was exposed we follow the breach notification policy.
Monitoring
The production application runs on managed infrastructure (Vercel, Render and Supabase) with error monitoring. Row-level security limits what a flaw in one place can expose.
- Row-level security in the database, so each account can read only its own rows. Your browser never queries the database; every read runs through our API, scoped to the signed-in account.
Not yet in place
- Scheduled third-party penetration testing: not yet in place.
- A bug bounty programme: not yet in place.
- Published fix deadlines by severity: not yet in place.
- Automated scanning of dependencies for known vulnerabilities in our build pipeline: not yet in place.
- Formal third-party security certifications (for example SOC 2 or ISO 27001): not yet in place. We hold none.
Contact
Write to security@cerqular.ai for anything on this page. For personal data requests write to privacy@cerqular.ai.
Status of this text
Counsel review of this policy has not been completed. It states what the code and the infrastructure do today, and where a control is not yet in place it says so.