Your certificates are compliance records. We treat them that way.
Certification data has to be accurate, attributable and available when a customer or regulator asks. These are the controls behind that promise.
Controls
What protects your data
A short, honest summary of the measures in place today — you can verify the ones that matter to you in practice.
Encrypted in transit
Every request between your browser, the field app and our servers runs over HTTPS with modern TLS.
Isolated document storage
Templates, generated certificates and uploaded evidence live in object storage with scoped, signed access rather than public URLs.
Role-based access
Team members only see the certificates, customers and templates their role and team membership allow.
Credential hygiene
Passwords are stored as salted hashes. API keys and integrations secrets are held server-side and never shipped to the browser.
Managed database
Production data runs on a managed PostgreSQL instance with restricted network access and routine backups.
Operational visibility
Failed sign-ins, integration errors and background jobs are logged so unusual activity can be investigated.
Data handling
How we treat customer records
Straightforward practices, written so they can be checked rather than just claimed.
We collect the minimum needed to run the service: account details, team membership, the documents you upload and the outputs generated from them.
AI processing is used to read document layouts and extract fields. We do not sell your data or use customer documents to train public models.
Records can be deleted on request, subject to the compliance retention described in the privacy policy.
Third-party processors are limited to infrastructure, email delivery, payments and AI processing — each used only for the function they provide.
Reporting a security concern
If you believe you have found a vulnerability, please contact us before disclosing it publicly. Include the steps to reproduce the issue and any affected URLs or accounts. We will acknowledge the report, keep you updated while we investigate, and credit you if you would like.
Contact the teamFull detail on data collection, retention and deletion is in the privacy policy.
Need a security conversation before you roll out?
We will talk through hosting region, retention, access model and the integrations your team relies on.