Security is not a feature bolted on to Circle247, it is the reason the app exists. This is a plain overview of how we protect your data. It is a summary rather than a full technical specification.
Encryption
- In transit: all traffic between the apps, the website and our servers is encrypted using TLS (HTTPS). Data is never sent in the clear.
- At rest: data stored on our servers and in our databases is encrypted at rest.
Where your data is hosted
Circle247 is hosted on servers located in the United Kingdom or European Economic Area, with providers that maintain recognised security standards.
Access controls
- Access to personal data is limited to the people who need it, on a least-privilege basis.
- Staff and contractor access is authenticated and logged.
- Sensitive settings live on the web, and the mobile app is deliberately thin, which reduces what is exposed on a device.
Keeping the service safe
We apply security updates, protect our forms and sign-in against abuse, and monitor for unusual activity so we can act quickly.
If something goes wrong
We keep a data breach process. If a personal data breach occurs we will contain and assess it, notify the Information Commissioner's Office within 72 hours where the law requires, and tell affected people where there is a high risk to them, with clear advice on what to do.
Reporting a concern
If you believe you have found a security issue, please tell us in confidence at hello@circle247.co.uk and give us a reasonable chance to fix it before sharing it publicly. We are grateful for responsible disclosure.