Important Announcements

23. October 2026

Security Advisory: Proactive SMS Hygiene and Messaging Safety

In line with our commitment to user security and data integrity, we want to remind all customers and users to practice proactive security hygiene regarding SMS communications.

While Circularo relies on SMS notifications to provide quick updates for text-based authentication and account activity, our mobile alert layout follows strict rules to ensure data protection. Malicious actors across the industry frequently use text-based social engineering tactics - commonly known as smishing (SMS phishing) - to mimic trusted platforms like ours.

We strongly encourage our user base to remain vigilant against unexpected or unsolicited mobile notifications.

How Circularo SMS notifications work

The Circularo platform legitimately sends automated SMS alerts to notify you of explicit account interactions. Because these alerts are strictly informational, there are clear rules that distinguish an authentic Circularo message from an impersonation attempt.

Circularo only sends two specific types of text notifications:

1. Verification Codes:
   Your verification code is 111111 (a number)

2. Document Alerts:
   You have a document waiting for your attention. {document title}

Legitimate automated text notifications from Circularo will:

• Contain plain-text updates regarding account actions you initiated.

• Never contain an active web link (http:// or https://) asking you to view or interact with an external document.

• Never ask you to directly open a file from the text message interface.

Be particularly cautious when a text message:

• Directs you to an embedded hyperlink to "sign a document," "verify an invoice," or "unlock your Circularo account."

• Creates immediate urgency, demanding you act within a few hours to prevent an account suspension.

• Asks you to reply directly with sensitive data, such as passwords, personal details, or one-time verification codes.

• Appears unexpected or completely out of context with your current business workflow.

Important: Sophisticated attackers can spoof sender IDs to make a malicious text appear in the same message thread as historical, legitimate alerts. Always evaluate the content of the message rather than relying solely on the thread hierarchy or the displayed sender title.

What Circularo will never do

Circularo employees, automated workflows, and mobile alert systems will never send you an SMS message containing a link that asks you to log in, review credentials, or sign a document.

All legitimate document interactions, signing workflows, and profile management actions must take place securely inside the platform. To review your pending tasks, always access your account through your trusted web browser bookmark, directly via your dedicated enterprise sub-domain, or inside our official mobile application.

What to do if you receive a suspicious text

If you receive an unexpected text message that claims to be associated with Circularo:

• Do not click any embedded links and do not open any truncated/shortened URLs.

• Do not reply to the message, as this confirms your phone number is active to automated spam networks.

• Check whether you were actively expecting a document to be signed or a verification event from the designated {company name}.

• Take a screenshot of the text message, noting the sender number and time received.

• Report the event immediately to our security operations team at security@circularo.com.

Remember

Check the message layout. Check the context. Circularo notifications inform you; phishing messages direct you. When in doubt, bypass the text entirely and log directly into the official http://circularo.com portal.

** *

Looking ahead: Secure document notifications through additional channels

In upcoming versions, Circularo may expand its communication capabilities, enabling authorized users to send document notifications and requests for signature through additional channels, including SMS, WhatsApp and other supported messaging services. These notifications may contain links that allow recipients to access the relevant document or signing workflow.

This will be a dedicated Circularo platform functionality, designed to support secure, controlled document interactions beyond traditional email-based communication. Links generated through this functionality will be part of the relevant Circularo workflow and subject to the security controls implemented for the feature.

Important: Until this functionality is officially released and the applicable guidance is published, the current security advice remains unchanged: legitimate Circularo SMS notifications contain no active links. Do not assume that a message containing a link is authentic simply because it refers to Circularo, a document you recognize, or an expected signing request.

When the new functionality becomes available, we will publish updated guidance explaining how to recognize legitimate notifications, verify their authenticity, and interact with documents securely through these additional channels.

2. September 2026

Security Advisory: How to Identify Legitimate Circularo Emails

In light of recent reports of email phishing campaigns impersonating companies, organizations, and individuals, we strongly encourage all Circularo customers and users to remain vigilant when receiving unexpected emails containing document links, requests to review or sign documents, or requests to provide information.

Phishing emails can be highly convincing. They may use familiar company names, branding, business contexts, document names, or even impersonate people you know in order to encourage you to click a link or provide your credentials.

How Circularo document notifications work

Circularo can legitimately send email notifications when someone requests that you view, download, review, approve, or sign a document. Therefore, receiving such an email does not by itself mean that the message is suspicious.

However, there are simple ways to verify whether a notification is coming from the Circularo platform.

Legitimate automated Circularo platform notifications are sent from:

noreply@circularo.com

and links provided by the Circularo platform lead to a *.circularo.com domain.

For example, a legitimate notification may direct you to a Circularo service hosted on a subdomain of circularo.com.

Be particularly cautious when:

• an individual claiming to be a Circularo employee sends you a document-access or authentication link directly;

• an email claiming to be from Circularo comes from an address other than noreply@circularo.com;

• a link takes you to a domain that is not a *.circularo.com domain;

• you are unexpectedly asked to provide your password, authentication code, or other credentials;

• an email creates urgency or pressure to immediately open a document or complete an action;

• the request is unexpected or inconsistent with your communication with the sender.

Important: Do not rely solely on the sender's display name. Always check the actual email address and, before entering any credentials, verify the domain of the website you have been directed to.

What Circularo will never do

Circularo employees will not directly send you a link asking you to enter your Circularo credentials in order to view, download, review, or sign a document.

Document requests and notifications generated by the Circularo platform are delivered through the platform's automated notification system.

If you are asked by an individual claiming to represent Circularo to authenticate through a link, provide your password, or provide other sensitive information, stop and verify the request before taking any action.

This is similar to the security practices used by banks and other trusted services: an unexpected email should never be treated as sufficient reason to disclose your password or other sensitive authentication information.

What to do if you receive a suspicious email

If you receive an unexpected or potentially suspicious email:

• Do not enter your password or other credentials.

• Check the actual sender email address, not just the displayed name.

• Check where the link leads before proceeding. Circularo platform links use a *.circularo.com domain.

• If the message claims to have been sent by a person or organization you know, contact them through a trusted communication channel and confirm that they intentionally sent the message.

• Do not download or open unexpected attachments.

• If you are unsure, do not interact with the message.

If you believe an email may be a phishing attempt, or you are unsure whether a message claiming to be related to Circularo is legitimate, please forward the email to security@circularo.com for review.

If you have already entered your credentials into a suspicious website, please report it to security@circularo.com immediately.

Remember

Check the sender. Check the destination. Never disclose your credentials to an unexpected request.

A legitimate Circularo document notification can ask you to view, review, or sign a document. What matters is how the request reaches you and where the link takes you.

When in doubt, stop and verify before proceeding.

11. August 2026

Effective January 1, 2027, Circularo will no longer support Docker-based deployments. Kubernetes-based deployments will be the only supported deployment model. Support for existing Docker-based deployments will end on December 31, 2026.

Circularo has been running on K3s, a lightweight Kubernetes distribution, since 2025. Our current and future development is focused exclusively on Kubernetes-based environments, and new Circularo releases are no longer being developed or tested with Docker-based deployments in mind.

To ensure continued access to product updates, technical support, security improvements, and compatibility with future releases, customers currently using Docker should plan to migrate their Circularo deployment to K3s before the end of 2026.

For all on-premises customers, Circularo offers a dedicated migration service to help move existing deployments from Docker to K3s. Our team can assist with planning, preparation, migration, and validation to help ensure a smooth transition.

To discuss the migration service or request further information, please contact delivery@circularo.com.

We recommend beginning the migration planning process as early as possible to allow sufficient time for assessment, scheduling, and implementation.

1. August 2026

We would like to kindly remind all customers, partners, and stakeholders of the importance of using Circularo's official support channels for all support, operational, technical, security, certificate, infrastructure, and service-related requests.

Over the past months, we have identified several situations where support requests were sent directly to individual Circularo employees instead of being submitted through our official support process. In some cases, this resulted in delays in response and resolution times because the messages did not reach the teams responsible for handling and tracking customer requests.

To ensure timely response, proper prioritization, and full visibility of all requests, all support-related communication must be submitted through: support@circularo.com

This mailbox is monitored by our support and operations teams and ensures that requests are properly recorded, assigned, tracked, escalated when necessary, and handled in accordance with applicable service levels.

Please note that requests sent directly to individual Circularo employees, managers, executives, project team members, consultants, or other staff members may not receive a timely response due to leave, travel, project commitments, spam filtering, workload distribution, or other operational factors. Direct communication should not be considered a substitute for the official support process.

For critical incidents requiring urgent attention, please continue to follow the agreed escalation procedures, but always ensure that the issue is also reported through the official support channel so that the incident can be properly logged and managed.

Your cooperation helps us provide the highest level of service, maintain clear accountability, and ensure that requests are addressed by the appropriate specialists without unnecessary delays.

21. April 2026

In light of emerging reports between April 13–15 of alleged cyberattacks by an Iran-linked group against major UAE organizations, we proactively implemented additional security measures.

The platform upgrade (version 26.0.0) was successfully initiated on April 14, 2026 at 20:00 GST and completed within approximately 90 minutes across all tenants. Following the upgrade, the platform remained stable and was continuously monitored through the night and into the morning of April 15.

On April 15, in response to emerging reports of cybersecurity incidents affecting certain organizations in the UAE, our team initiated additional precautionary security enhancements. These included the deployment of updated security policies and corresponding infrastructure changes.

Due to the nature of these changes, deployment was carried out in several consecutive waves throughout the day. During this process, the platform experienced intermittent periods of reduced responsiveness, with cumulative impact estimated at less than 45 minutes.

While we aim to be as transparent as possible, some specific technical details of the security measures implemented are intentionally not disclosed, in line with best practices to avoid exposing information that could be leveraged by malicious actors.

We would like to emphasize that at no point was customer data at risk. All data remained fully secure, and backup operations continued to run as scheduled without interruption. This ensured continued data integrity, availability, and recoverability at all times.

The platform is currently operating normally and securely. We continue to closely monitor performance and remain in regular contact with our infrastructure partners to ensure ongoing stability.

31. March 2026

We are pleased to announce that Circularo has successfully obtained the Dubai Electronic Security Center (DESC) Cloud Service Provider (CSP) Security Standard Certification.

This certification represents one of the most rigorous cybersecurity frameworks in the region and is a mandatory requirement for cloud service providers serving government and semi-government entities in Dubai. It validates that Circularo meets strict standards for information security management, operational resilience, and risk control, aligned with internationally recognized frameworks such as ISO/IEC 27001 and ISO/IEC 27017 .

Achieving DESC certification further strengthens Circularo’s commitment to providing a secure, reliable, and compliant digital trust platform for our customers across the UAE and beyond. Learn more in our blog.

* * *

At the same time, we would like to reaffirm that all Circularo services continue to operate normally and securely across all regions. Our infrastructure, monitoring, and contingency measures remain fully in place, ensuring uninterrupted service and protection of customer data.

We will continue to share any important updates through this page as the situation evolves.

17. March 2026

In light of recent media coverage regarding the evolving regional situation, including reports of potential Iranian actions targeting international businesses and technology infrastructure in the region, we would like to provide an update on the status of Circularo services.

All Circularo instances hosted in Microsoft Azure data centers in the UAE North (Dubai) and Central (Abu Dhabi) remain fully operational and unaffected. There has been no disruption to service availability.

All backup operations continue to run as scheduled without interruption, ensuring the integrity and security of customer data at all times.

We remain in close coordination with our infrastructure partners, including Microsoft Azure, and are actively monitoring the situation. This includes developments related to increased geopolitical tensions and reported risks to IT infrastructure in the region.

Our contingency plans remain fully in place. In the event of any force majeure situation, we are prepared to seamlessly continue service delivery for UAE customers from our Microsoft Azure data center in the Netherlands, as previously communicated.

For customers in Qatar, our recommendation remains unchanged. We advise continuing using our Microsoft Azure data center in the Netherlands (app.circularo.com) until the situation changes. This environment is currently used by all Qatari customers and fully complies with Circularo’s security standards and international data protection best practices. 

There is no impact on the security, privacy, or confidentiality of customer data.

We will continue to monitor the situation closely and share any important updates through this page.

Looking ahead, we would also like to confirm that our upcoming platform release (26.0.0) is proceeding as planned, with no delays expected. We anticipate rolling out the new version across all data centers around April 14th.

* * *

Our services continue to run normally and securely. We are closely monitoring the situation and remain in regular contact with our infrastructure partners in the region to ensure continued stability and performance.

If you have any questions or require any assistance, please do not hesitate to contact our support team.

We remain fully committed to maintaining reliable and secure service for all our customers.

6. March 2026

In light of the recent developments in the Gulf region and their impact on parts of Abu Dhabi, Dubai, Doha, and many others, we would like to share some important information about our system, data and infrastructure.

Circularo is hosted on MS Azure infrastructure in the UAE, which uses two geo-redundant data centers - UAE North and UAE Central. At the moment, all UAE-based customers are restricted to the UAE datacenters to comply with data residency laws. 

Apart from that, Circularo has also datacenters in KSA (Oracle Cloud) and in Europe (MS Azure).

If one of the datacenters was damaged, or otherwise not operational, Circularo would automatically switch to the geo-redundant center within the same region. 

When it comes to the data itself, regular database backups for the entire application are performed on our cloud environments. These backups are stored in geo-redundant locations, each backup is kept for 21 days. Backups are performed every hour, and the freshness of these backups is continuously monitored. If any backup is older than 90 minutes, an alert is triggered and sent to the monitoring team to inform them of the issue. Backups are stored with point-in-time restore capability, ensuring that backups are not only highly available but also can be restored to specific points in time.

Circularo also maintains the capability to perform a secure backup of all customer data outside the selected data residency in the event of force majeure. Our designated contingency location for such scenarios is the Microsoft Azure data center in the Netherlands.

This capability ensures we are prepared to execute such an operation if necessary, however, any action would require prior agreement with the customer and would be arranged according to their specific requirements. 

* * *

Our services continue to run normally and securely. We are closely monitoring the situation and remain in regular contact with our infrastructure partners in the region to ensure continued stability and performance.

If you have any questions or require any assistance, please do not hesitate to contact our support team.

We remain fully committed to maintaining reliable and secure service for all our customers.