How Certivo protects your data

Certivo runs on hardened, access-controlled cloud infrastructure. Production data is isolated from development and test environments, administrative access requires strong authentication, and infrastructure changes follow reviewed, auditable processes.

Customer data is encrypted in transit using TLS 1.2+ and at rest using AES-256. Secrets and credentials are held in managed secret storage, never in source control, and access to keys is restricted and logged.

Access follows least-privilege principles. Within the product, role-based access control scopes what each user can see and do, and SSO/SAML is available on Enterprise plans. Internal administrative access is limited to personnel who need it and is reviewed periodically.

Passwords are hashed with argon2id. Sessions are signed and http-only. Mutating requests are CSRF-protected, and all inputs are validated with typed schemas. Security headers (HSTS-ready, X-Frame-Options, nosniff, strict referrer policy) are set at the edge, and dependencies are monitored for known vulnerabilities.

Every record is scoped by organisation. Queries are constrained to the caller's tenant, and there are no cross-tenant reads. This isolation is enforced consistently across the API and the application.

Every mutating action is recorded in an append-only audit log capturing who did what and when. Audit trails support investigation, four-eyes review and evidence for the customer's own regulatory obligations.

We collect only the data needed for the configured purpose, retain it per the customer's policy, and delete or anonymise it when no longer required. Personal data captured during verification is minimised and handled in line with our Privacy Policy and DPA.

Regular, encrypted backups support recovery, and continuity procedures are designed to restore service in the event of disruption. Recovery objectives are set commensurate with the criticality of the platform to regulated operations.

Our control framework is aligned to SOC 2 and ISO 27001 practices. In this evaluation environment, formal attestations are represented as in-progress; the underlying controls are implemented in the platform. See our Compliance & Regulatory overview.

Found a vulnerability? Email security@certivo.uk. We acknowledge reports within two business days and ask that you give us a reasonable opportunity to remediate before any public disclosure.