How Certivo protects your data

Security is layered so no single failure exposes customer data. Each layer below is an independent control; the sections that follow describe them in detail.

Certivo runs on hardened, access-controlled managed cloud infrastructure — a Next.js application on Vercel with a managed Neon Postgres database in an EU/UK region. Production data is isolated from development and test environments, administrative access requires strong authentication, and infrastructure changes follow reviewed, auditable processes.

Customer data is encrypted in transit using TLS 1.2+ and at rest using AES-256. Secrets and credentials are held in managed secret storage, never in source control, and access to keys is restricted and logged.

Access follows least-privilege principles. Within the product, role-based access control scopes what each user can see and do, and SSO/SAML is available on Enterprise plans. Internal administrative access is limited to personnel who need it and is reviewed periodically.

Passwords are hashed with argon2id. Sessions are signed and http-only. Mutating requests are CSRF-protected, and all inputs are validated with typed schemas. Security headers (HSTS, Content-Security-Policy, X-Frame-Options, nosniff, strict referrer policy and a restrictive permissions policy) are set at the edge, server fingerprinting is disabled, and dependencies are monitored for known vulnerabilities.

The REST API is authenticated with organisation-scoped API keys passed as bearer tokens; only a hash of each key is stored. Requests are validated against typed schemas, errors return a consistent machine-readable envelope with no stack traces, and unauthorised calls return a clean 401. Keys can be rotated and revoked from the console.

Every record is scoped by organisation. Queries are constrained to the caller's tenant, and there are no cross-tenant reads. This isolation is enforced consistently across the API and the application.

Security is built into how we ship, not audited in afterwards:

• Changes are reviewed before reaching production and carry an auditable history.
• Type-checking and typed input validation catch whole classes of error before release.
• Secrets are gitignored and injected from managed storage at deploy time.
• Dependencies are monitored for advisories and updated promptly.
• Production, staging and development are isolated from one another.

Every mutating action is recorded in an append-only audit log capturing who did what and when. Audit trails support investigation, four-eyes review and evidence for the customer's own regulatory obligations.

We collect only the data needed for the configured purpose, retain it per the customer's policy, and delete or anonymise it when no longer required. Personal data captured during verification is minimised and handled in line with our Privacy Policy and DPA. A fuller data lifecycle is described in the Trust Center.

We monitor dependencies and infrastructure for known vulnerabilities and remediate on a risk-prioritised basis. Reports from external researchers are triaged through our responsible disclosure process. Security incidents affecting customer data are handled under a defined process and communicated in line with our contractual and legal obligations, including the DPA.

Regular, encrypted backups support recovery, and continuity procedures are designed to restore service in the event of disruption. Recovery objectives are set commensurate with the criticality of the platform to regulated operations.

Our control framework is aligned to SOC 2 and ISO 27001 practices. Formal attestations are on our roadmap and in progress; they are not yet held. The underlying controls described on this page are implemented in the platform today. See our Compliance & Regulatory overview and the compliance roadmap in the Trust Center.

Found a vulnerability? Email management@certivo.uk. We acknowledge reports within two business days and ask that you give us a reasonable opportunity to remediate before any public disclosure. See our full Responsible Disclosure Policy (including safe-harbour) and Information Security Statement.