Curcle handles your customers’ sites, certificates and invoices. The controls below are how we keep that data safe — and the standards we’re working towards next.
Concrete controls built into the platform — not aspirations.
Every action in Curcle is tied to a named user with an enforced role.
Customer data is isolated per tenant and encrypted in transit and at rest.
The application ships with the controls a modern SaaS is expected to have.
We assume something will go wrong, and rehearse what happens next.
We’d rather be straight about where we are than dress up a badge we don’t yet hold.
Working through the NCSC five-control questionnaire — firewalls, secure configuration, patching, access control, and malware protection. Targeting self-assessed certification first, then Cyber Essentials Plus.
External-assessor verified version — required by most UK public-sector, NHS and large facilities-management buyers. Scheduled within six months of basic certification.
Triggered by customer demand. We will pursue SOC 2 when enterprise prospects start requiring it in procurement; until then, the controls below already cover most of the substantive requirements.
If you believe you’ve found a vulnerability in Curcle, please report it privately rather than disclosing publicly. Email support@curcle.co.uk with “Security issue” in the subject. We’ll acknowledge within 2 working days and keep you updated through to fix.
