Security Policy

Purpose of this policy

CurNext builds construction site intelligence on an industrial IoT and cloud stack. Security is part of how we design products, operate services, and work with customers - not a marketing overlay.

• - State CurNext security objectives and the systems this policy covers.
• - Summarise organisational and technical control themes used in production.
• - Explain access, vulnerability disclosure, and incident handling expectations.
• - Be honest about certification: design alignment is not the same as a completed third-party assessment.
• - Point to Security architecture, DPA, GDPR Policies, Audit Trail, and Datacenters for deeper detail.

CurNext does not claim ISO 27001 or SOC 2 certification for itself on public pages. Standards named on Security and Compliance pages are design alignment unless separately confirmed in writing.

Scope

This policy applies to CurNext-operated systems that process or protect customer and website data, including:

• - curnext.app marketing and documentation surfaces
• - dash.curnext.app and related product experiences
• - APIs, SDKs, and developer portals operated by CurNext
• - Cloud hosting, databases, backups, and observability for the production stack
• - Field and building edge components when they connect to CurNext cloud services (CN-FG, CN-BC, and related nodes as documented on Security)
• - Personnel, contractors, and subprocessors acting for CurNext on those systems

Security objectives

CurNext designs for the following objectives across the product stack.

Organisational measures

People and process controls sit alongside product engineering.

Access control

Access to CurNext product planes is intentionally constrained.

• - Invite-only provisioning - new Google or email logins do not auto-join a project without an invite or membership.
• - Under CurNext internal policies, we do not onboard, invite, or register product users under 18 years of age.
• - Role-based access control (RBAC) scopes what project members can see and change.
• - Privileged roles expect stronger authentication (MFA) and leave clearer audit evidence.
• - Tenant isolation keeps organisation and project data scoped - not a shared public feed across customers.

Data protection and hosting

Personal and site data in the cloud layer are handled with GDPR-oriented controls and EU-anchored production hosting by default.

• - Core application and database hosting oriented to Germany / Frankfurt (EU).
• - Encryption in transit and at rest for core stores.
• - Retention, export, and erasure themes documented in GDPR Policies, DPA, and Audit Trail.
• - Marketing-site cookies and similar technologies are covered by the Cookie Policy and consent widget.

Vulnerability disclosure

We prefer coordinated disclosure. Do not send exploit details to support@ or gdpr@.

• - Email [email protected] with enough detail to reproduce the issue.
• - Include affected product surface (web, API, firmware, gateway) and approximate timing.
• - Avoid public disclosure until we have had a reasonable chance to assess and remediate.
• - We will acknowledge reports and keep reporters informed of material progress where appropriate.

Security incidents and personal data breaches

CurNext maintains processes aimed at detecting, assessing, and responding to security incidents that may affect the Services or personal data.

Subprocessors and infrastructure

CurNext uses hosting, email, observability, and optional AI vendors under contractual controls.

• - EU-oriented hosting and database infrastructure for core production.
• - Public subprocessor summary on the Data Processing Agreement page.
• - Assisted AI features, when enabled, run under product and contractual controls - concrete curing prediction uses an in-house TensorFlow.js model.
• - Material subprocessor changes follow the notice process described in the DPA.

Customer responsibilities

Security is shared. Customers remain responsible for how they configure and use the Services within their organisation.

• - Invite only trusted collaborators and remove access when roles change.
• - Protect credentials, API keys, and MFA devices for admin accounts.
• - Do not share vulnerability details outside coordinated disclosure channels.
• - Configure project permissions and exports according to your own policies and contracts.
• - Report suspected account compromise to [email protected] promptly.

Changes to this policy

We may update this Security Policy when products, hosting, or organisational practices change. The Last updated date will change for material revisions. Architecture depth continues to live on the Security page.