Security
An electrical record is a security document. We treat it like one.
A full map of a building's distribution, its isolation points and its weak spots is the last document you want in the wrong hands. So it lives on your server, under your access control, with a name against every change.
- Single-tenant, self-hosted
- Air-gapped operation supported
- MFA on privileged accounts
- Signed releases + CycloneDX SBOM
Security by design
Four decisions taken before any feature was
These are built in, not settings. They are why the rest of this page is short.
Your data never shares a database
CircuitMap is a single-tenant install, not a shared service with a customer column. No query in the product could return another organisation's record, because another organisation's record is not in your database.
It does not need to reach us to work
Normal use needs no outbound connection at all. That is what makes CircuitMap workable on isolated and air-gapped sites, and it means an internet outage — ours or yours — does not take your electrical records with it.
Every change has a name on it
For a building record, knowing where a fact came from is most of its value. Changes carry who made them and when, so a schedule can be trusted rather than merely believed, and a deletion can be traced rather than argued over.
The browser is never trusted on its own
Sessions are checked server-side on every request, permissions are enforced server-side, and privileged accounts must complete MFA. Hiding a button is not access control, so we do not treat it as any.
Where your data lives
Three ways to run it, and what each one costs you in effort
Self-hosting is not free. Work we would otherwise do becomes your work. Better to be clear about that before you choose than after.
Self-hosted
The standard install
- Who holds the data
- You do, on your own server
- Who patches it
- You, using the signed packages and the runbook
- Internet needed
- Only to fetch updates
- Suits
- Most estates teams, most contractors
Air-gapped
No route out at all
- Who holds the data
- You do, on an isolated network
- Who patches it
- You, from media you carry in
- Internet needed
- None
- Suits
- Secure sites, utilities, defence and critical premises
Managed by us
Dedicated, still single tenant
- Who holds the data
- A dedicated instance we run for you
- Who patches it
- We do, in an agreed window
- Internet needed
- Yes
- Suits
- Teams with no server to put it on
What self-hosting actually means
You need a Windows server, somewhere off-machine to put encrypted backups, and someone willing to run an installer and read a runbook. In return you get full control of the data and an application that does not stop working when somebody else’s service does. We supply the signed packages, the install and update scripts, the preflight checks, the rollback path and the documentation. The uptime, the capacity and the patching window are genuinely yours. If that sounds like more than your team wants to take on, choose the managed option. Same product either way.
Controls
The specifics, grouped the way your IT team will ask for them
Network and infrastructure
- TLS on all browser traffic, with HTTP Strict Transport Security enforced in production
- Runs behind a hardened reverse proxy as part of the supported install
- We need no inbound access to your network for the product to run
- A release goes into a versioned, immutable directory, never a copied working tree
Data
- Records and uploads sit on your own install host, under your own retention policy
- Encrypted, verified, off-machine backups are part of the supported install
- Deletions go to a recycle bin, with a retention window before anything is gone for good
- Secrets and licence material are held encrypted and never committed to source control
Application
- Strict Content Security Policy with per-request nonces, and no arbitrary inline script
- Clickjacking protection and modern security headers throughout
- Server-side session checks and server-side permission checks on every request
- MFA mandatory for privileged tenant users and all operator accounts
- Rate limits and request size limits on sign-in and upload paths
- Uploaded files are checked by content, not by the extension a browser reports
Supply chain and release integrity
- Release packages are signed, and the signature is verified at install time
- Deterministic CycloneDX SBOMs are published from CI for both applications
- Migration preflight and health gates run before a release takes any traffic
- A tested rollback path, with backup verification built into the upgrade runbook
- Automated WCAG 2 A/AA checks and coverage thresholds on critical modules in CI
Operations and support
- Tenant and operator sessions are entirely separate and use different cookies
- Any remote support command is outbound-only, Ed25519-signed, targeted, expiring, single-use, allowlisted and audited on your own install
- The optional support relay is authenticated, and can simply not be set up
- Administrators decide which users may raise support tickets
Our approach
Boring on purpose
Security for a records system is not a feature list. It is the discipline of the defaults. Least privilege. Checks on the server, every time. No surprises about where the data sits or who can reach it. We would rather this page were dull and true than impressive and vague, and we would rather tell you what we do not have than let you assume we do.
Got a questionnaire, a procurement process or an information-security team with hard questions? Bring them to the demo. That is the conversation we would rather have early.
Security FAQ
What IT actually asks
Nine questions, in the order they usually arrive.
hello@circuitmap.co.ukIs our data ever mixed with another customer's?
Does CircuitMap phone home?
Can we run it with no internet connection at all?
How do we know a release has not been tampered with?
Who can see what, inside the application?
What about backups, and what if the server dies?
We have a security questionnaire. Will you complete it?
Which accreditations do you hold?
How do we report a vulnerability?
Bring your IT team to the demo
Thirty minutes, and we answer the architecture questions ourselves rather than sending a datasheet. If something is not built yet, we will say so.
No pitch deck. No credit card. No follow-up sequence.