CircleInformation Security Policy — Circle
Applies to: the Circle service, the data it holds, and everyone with access to them. Version: 4.0 · Effective: 2026-10-22 · Review cadence: at least annually, and after any material change. Security contact: security@horizonlogistics.info
1. Purpose and scope
Circle holds the operational, personal and financial data trucking companies depend on to run their business. This policy describes how we protect that data and how we detect, contain and recover from security incidents.
2. Roles and responsibilities
- Circle management is accountable for security, approves access to production and reviews this policy.
- The security contact maintains this policy, reviews access and coordinates incident response.
- Carrier administrators control who is in their workspace and which roles they hold.
- Every user is responsible for protecting the account they sign in with and for reporting anything suspicious immediately.
3. Separation of carrier data
Each carrier's data is kept separate from every other carrier's and is available only to that carrier's authorized users. No carrier can see another carrier's data.
4. Access control
- Sign-in is through the user's existing messaging or work account. Circle does not store user passwords. We recommend that all users enable two-step verification on the account they use.
- Role-based access is enforced for every request: management, dispatch, safety, fleet and accounting each reach only their areas. Financial actions are limited to explicitly authorized roles.
- Rate visibility: load rates are shown only to the driver types the carrier permits.
- Least privilege applies to our own operations: production access is limited to named administrators.
- Access is reviewed periodically and removed promptly when a team member leaves; carrier administrators can remove members at any time, which ends their access immediately.
5. Data protection
- We use industry-standard encryption in transit and at rest.
- We do not store Social Security numbers or full bank account or routing numbers; bank credentials are handled by the bank-connection provider.
6. Operations
- Change management: changes are reviewed and released through a controlled process before they reach production.
- Abuse protection: sign-in, public forms and connections are protected against automated abuse.
- Logging and audit: security-relevant actions (access changes, approvals, financial actions, connection changes) are recorded in a workspace activity log available to carrier management.
Vulnerability management and patching
We look for vulnerabilities continuously and fix them on a fixed timetable.
- How we find them: regular automated vulnerability scanning, timely security updates, security advisories from the providers we rely on, and reports sent to our security contact.
- How we rate them: by severity, on an industry-standard 0–10 scale — raised one level when a vulnerability is being actively exploited or is reachable from the internet.
- How fast we fix them, counted from when we learn of the vulnerability:
| Severity | Score | Fixed or mitigated in production within |
|---|---|---|
| Critical, or actively exploited | 9.0 – 10.0 | 7 days (mitigated within 72 hours where a fix is not yet available) |
| High | 7.0 – 8.9 | 30 days |
| Medium | 4.0 – 6.9 | 90 days |
| Low | 0.1 – 3.9 | 180 days, or the next scheduled maintenance |
- How we fix them: every finding is reviewed within two business days and fixed through our normal change process. If a vulnerable component cannot be reached in our service, we may lower its priority, recording the reason.
- Exceptions: when a fix cannot meet its deadline, the exception is written down with the reason and the protective measure in place meanwhile, approved by Circle management, and reviewed at least every 30 days until closed.
7. Third-party providers
We use a small number of trusted service providers (for sign-in, message delivery, bank connections, hosting, mapping and AI-assisted processing), together with the outside services carriers choose to connect. Providers are chosen for their security posture and receive only the data needed for their function.
8. Incident response
Suspected incidents are reported to the security contact immediately. Response follows a fixed sequence: contain (revoke access and sessions, isolate what is affected), assess scope, remediate, restore service and data where needed, and notify affected carriers without undue delay where their data is involved. Every incident ends with a review that updates this policy and our controls.
9. Review
This policy is reviewed at least annually and after material changes (new data types or providers). See also the Data Retention & Deletion Policy and the Privacy Policy.