SECURITY & TRUST
This page records the Castia-specific evidence available for public reliance. Missing proof stays unavailable instead of inheriting a generic security, privacy, certification, or residency promise.
PUBLIC TRUST LEDGER
“Not verified for public use” means the website cannot support that claim today. It is not a statement that the underlying control is absent.
No Castia-specific public data-flow diagram or approved list of processors, model providers, and transfer boundaries is available. Buyers should not infer one from circuly material.
No Castia-specific public retention schedule, deletion timetable, or backup-deletion statement is approved. Product evaluation must treat those terms as unconfirmed.
The website does not publish a reviewed technical control statement for tenant isolation, privileged access, authentication, or authorization. No assurance should be inferred.
Public product pages describe human review before an exact outreach batch is approved. A separate technical assessment of enforcement, event coverage, and audit-log retention is not yet published.
No Castia-specific residency region or customer-selectable hosting option is published. Residency must be confirmed in writing for the exact product scope before reliance.
Security concerns and suspected incidents can be sent to [email protected] with “Castia security” in the subject. This contact route does not imply a published response-time commitment.
No Castia certification is published. The site does not claim a Castia-specific ISO, SOC, penetration-test, availability, or independent assessment status.
The linked privacy, terms, and DPA pages are circuly GmbH documents. They support evaluation of the legal entity but do not by themselves establish Castia product coverage; confirm the applicable product and processing scope in writing.
SENSITIVE-DATA BOUNDARY
Sensitive-data workflows are not publicly supported.
Insurance and M&A examples stay within public-source research and explicit human decision boundaries. A campaign that requires policy records, confidential deal information, special-category data, or another sensitive source remains unavailable until its data flow, controls, legal basis, and operating evidence are reviewed for that exact use.
DOCUMENT SCOPE
These are circuly GmbH documents. They do not by themselves establish Castia product coverage; confirm the exact entity, service, processing role, and version that would apply.
Security contact
[email protected]Published review cadence
Monthly, and after any material system change.
Next scheduled review: 28 August 2026.