Security and compliance

Last updated: 13 October 2026

Reporting a vulnerability

If you believe you have found a security vulnerability in a CloudRF service, please tell us.

  • Email: support@cloudrf.com with “Security” in the subject.
  • Include: the affected URL or endpoint, what you observed, and steps to reproduce it.
  • Our response: we aim to respond within 24 hours and to fix the issue within 7 days.

Please do not include other people’s data in a report, and give us a reasonable time to fix an issue before you disclose it.

Our terms do not permit security testing, benchmarking or enumeration of the public service (clause 5.3). Report what you have noticed in normal use; do not probe the service to find more. If you need to test CloudRF as part of an accreditation, contact us first or evaluate a self-hosted SOOTHSAYER server.

Our contact details are also published at /.well-known/security.txt.

Compliance

  • Cyber Essentials Plus: CloudRF (Farrant Consulting Ltd) is certified under the UK Cyber Essentials Plus scheme. Certificate 8b185176-edc2-49e1-b6e2-c906b2a3e8d9, valid until 25 November 2026. Verify our certificate on the Blockmark registry. Our current and previous certificates are listed on our registry organisation page.
  • Penetration testing: we undergo annual penetration testing. Certification is available on request.
  • UK GDPR: we process personal data under the UK General Data Protection Regulation and are registered with the Information Commissioner’s Office, reference ZB214600. See our privacy policy.

How we protect your data

  • Hosting: your data is stored on dedicated servers in our secure data centre in the UK.
  • Network: the hardened servers are protected with firewalls and intrusion detection systems, and are monitored continuously with automated alerting.
  • Vulnerability management: we run continuous vulnerability scans to detect vulnerabilities early.
  • Encryption in transit: the API and website are served over TLS.
  • Access: a minimal number of experienced staff have access to your data. Contractors and third parties do not.
  • Payments: payment information is managed by Stripe. We hold no card details beyond a random token.
  • Passwords: account passwords are stored hashed.
  • Marketing: we do not use third-party mailing list or marketing software.

API keys

  • Each account has a private API key, sent in the key request header.
  • A key does not give access to your interface login or account management.
  • Store keys in environment variables or private files, never in source code.
  • If a key has been exposed or needs to be revoked, email support@cloudrf.com from the address on your account. We will revoke it and create a new key.

Service status

Live status for the API and interfaces is at status.cloudrf.com.

Private deployments

For networks that cannot use a public service, the SOOTHSAYER server runs on your own hardware, offline if required. See SOOTHSAYER.