Charle Security Overview

Applies to: CSignal and the way Charle handles client data Version: 1.0 Last updated: 2 October 2026

This is a plain-English summary of how we protect your data. It is designed to answer the questions brands most often ask us. If you have a security questionnaire, send it to hello@charle.co.uk and we will complete it.

Where your data lives

Your CSignal data and visitor analytics are stored in the United Kingdom (London).
Our application servers and some providers run outside the UK, mainly in the US, under standard legal safeguards.
We host with established cloud providers that run their own security and compliance programmes.

How it is protected

Encryption in transit (TLS) and at rest.
Client separation: every client's data is kept separate and access is enforced at the database level by row-level security, so one client can never see another's data.
Least-privilege access: our team can only reach what their role needs, and access is removed when someone leaves.
No passwords to steal: CSignal signs people in with one-time email links, so there are no CSignal passwords to reuse or leak.
Scrambled IP addresses: visitor IP addresses are stored only as an irreversible, salted hash.
Automatic deletion: raw visitor events are deleted after 12 months.

Access to your systems

We never store passwords for your systems in CSignal. When we need access to your store or tools, please invite our team as staff or collaborators, so you stay in control and can remove access at any time.
CSignal records which access each piece of work needs, and whether it has been granted.

Our team and suppliers

Everyone at Charle is bound by confidentiality.
We work only with established providers, under written contracts that protect your data. The categories we use, and where they operate, are listed in our CSignal Platform Privacy Policies and our Data Processing Agreement. The named list is available on request.

If something goes wrong

We have a documented incident response process.
If a breach affects your data, we will tell you without undue delay, and within 48 hours of becoming aware of it where we act as your processor, and we will notify the regulator where the law requires.

Your data, your rights

You can ask us to export or delete your data at any time.
Our Data Processing Agreement sets out exactly how we handle data on your behalf.

Contact

Security questions, questionnaires, or something to report: hello@charle.co.uk.