Security
Proven controls — no invented certifications
We describe what the platform actually enforces today. We do not claim SOC 2, ISO 27001 or government certification.
- Invite-only access; public signup remains closed.
- Organisation tenancy from the authenticated session — never from request parameters.
- Private media storage with short-lived authorised access.
- Human approval before draft detections become register totals.
- Auditable decisions on material mutations.
- Secure authentication, CSRF protections and controlled exports.
Host separation: the marketing site at circuasset.com does not register the application service worker or show install prompts. The authenticated product lives at app.circuasset.com.