Curo is built so that the usual ways websites get broken into don’t apply, and so that your account, your team and your visitors stay safe. Here’s how, in plain words. Questions about security, or something to report: support@curocms.com.
1. Your website is plain files
When someone visits your site, they’re sent finished pages. No database is read and no website software runs, so the attacks that break into most small business websites have nothing to work on. Code only runs for your editor and for your forms, and both are protected as below.
2. Signing in
- Two-step sign-in: a code from an authenticator app as well as your password. An Owner can make it compulsory for the whole team.
- No leaked passwords: Curo refuses passwords that have appeared in known data breaches. It checks privately: your password never leaves your site.
- Alerts: we email you when your account is signed in to from a browser it hasn’t seen before.
- Where you’re signed in: Your account lists every browser you’re signed in on, and signs out all the others in one click.
- Guessing is stopped: repeated wrong passwords, codes and sign-in links are slowed down and then blocked.
- Passwords are stored with Argon2id, the current standard, and never kept as they were typed.
3. Your team
- Roles: Owners, Editors and Contributors each see and do only what they need. A Contributor’s changes wait for an Owner or Editor to approve them.
- Every change recorded: who changed what, and when, in your site’s activity history. Each entry is chained to the one before, so the history can’t be quietly altered.
- Undo: any change can be undone, and earlier versions brought back.
4. Curo AI
Curo AI can only change the words, photos and lists you can edit yourself. Every change it suggests is checked by your site before you see it, and nothing goes live until you approve it.
5. Every page, every form
- Every site has a free certificate, so pages and the editor are always sent securely (HTTPS).
- Pages tell browsers to load nothing that isn’t part of your site, and not to let other websites show them in a frame.
- Forms are protected from spam, with Google reCAPTCHA if you connect it, and limits on how often they can be sent.
- Uploaded photos are checked, re-saved and stripped of hidden location data before they appear on your site.
6. Updates and the code behind Curo
- Curo updates itself. Every new version goes to a few sites first, and to everyone else only once those have updated cleanly.
- Before any version goes out, everything it’s built from is checked against the public database of known security problems, and it isn’t released if anything is found. The same check runs every week between versions.
7. Your data
- Your website and Curo are hosted in the UK.
- Passwords, keys and connections to other services are stored encrypted.
- Card payments go straight to Stripe. We never see or store your card details.
- How we use personal data is in our Privacy policy.
8. Found a problem?
If you think you’ve found a security problem in Curo, email support@curocms.com. We’ll reply quickly and keep you updated while we fix it.