Legal

Security and data storage

Version 1.1 · last updated 9 November 2026

You put certificates, inspection records and personal data about your people into Certly. You want to know where that lives and who can reach it. This page sets out exactly how we handle it, plainly and without marketing language.

In short

• Your data and files are stored in the EU (Frankfurt and Dublin).
• Everything is encrypted, in transit (TLS) and at rest (AES-256).
• Every organisation is strictly separated; nobody outside your own team can reach your documents.
• Files sit in private storage and can only be opened through short-lived links.
• We rely on a small number of providers that are themselves SOC 2 or ISO 27001 certified.
• A data processing agreement is part of our terms; a signed copy is available on request.

Where is your data?

Your data leaves the EU only in the two cases listed under providers below: the support chat and the optional AI extraction.

Encryption

• In transit: all traffic runs over HTTPS (TLS). Unencrypted connections are refused and browsers remember that (HSTS, preloaded).
• At rest: the database and file storage are encrypted with AES-256 by default at Supabase/AWS.
• Passwords: we never store a password, only a bcrypt hash. We cannot read your password either.
• Integration keys for external systems are encrypted separately (AES-256-GCM) before they enter the database.

Separation between customers

Certly is a shared service in which every organisation has its own walled-off environment. Every query in the code is bound to the organisation of the signed-in user; a request without that binding does not get through. Files are stored under a path that starts with your organisation, and a download link is only generated after the document has been confirmed to belong to your organisation. The most recent review of the code (October 2026) found no way for a user of organisation A to view or change data of organisation B.

Access and sign-in

• Roles: owner, manager and viewer. Viewers cannot change anything and do not see integrations or share links.
• External advisers: you can give a health and safety consultant from outside your company access with their own login. You choose the role (manager or viewer); an adviser never becomes the owner and cannot change the subscription, team or settings. Every request re-checks that the access still holds, so revoking works immediately. An adviser only sees the organisations that invited them.
• Sign in with email and password, or with your Google or Microsoft work account. With the latter, your own company's two-factor authentication applies automatically. Built-in two-factor authentication for password accounts is on our roadmap.
• Protection against guessing: failed sign-in attempts are limited per account and per IP address. Password reset links are valid for one hour and single-use.
• Sessions use secure cookies that travel only over HTTPS and cannot be read by scripts.
• Access at Certly: only the team that operates the service can reach production systems, solely for administration and support. We never look into your data unless you ask us to.

Uploaded files

• Storage is private. A file can only be opened through a link that expires after one hour and is only issued to a signed-in member of your organisation.
• We accept PDF, JPEG, PNG, WebP and HEIC up to 10 MB. The file type is checked on content, not just the extension, so no executable or script files get in.
• Delete a document, holder or subcontractor and the associated files are removed with it.

Retention, export and deletion

• Your data is yours. You can create a full audit export at any time: an overview of all holders and documents plus every attachment.
• If you cancel, we delete all data and files of your organisation within 30 days. That happens automatically and is irreversible.
• Holders you delete yourself disappear from the live service immediately.

Providers and their certifications

Certly is a small team. We build the service ourselves, but we leave the infrastructure underneath to providers that are independently audited. These are all the parties that can process customer data:

We have a data processing agreement with each of these parties. For the parties outside the EU, EU standard contractual clauses (SCCs) or the EU-U.S. Data Privacy Framework apply. For UK customers the UK GDPR and the UK Addendum to the SCCs apply alongside them. Certifications are as published by the providers on their own trust pages.

Is Certly itself certified?

No. Certly holds no ISO 27001 or SOC 2 certificate of its own. We are upfront about that: for a small team such a programme is a large investment that would currently go into paperwork rather than into better security for you. What we do instead:

• Build on providers that are certified (see above).
• Have the full codebase reviewed for security periodically. The most recent review was on 30 October 2026; its findings were fixed the same day.
• Keep dependencies (software libraries) current and replace vulnerable versions immediately.
• Keep secret keys out of the code; every webhook and background job verifies a signature or secret before doing anything.
• Complete customer security questionnaires. Send yours to support@gocertly.com.

If a tender or a large client requires a formal certification such as Cyber Essentials or ISO 27001, let us know and we will discuss what is feasible.

Data breaches and incidents

If we discover a breach that affects your data, we notify you without undue delay with what happened, what the consequences are and what we have done. That lets you, as the data controller, report to the ICO in time. The full arrangements are on the GDPR & data protection page.

Found a vulnerability?

If you have spotted something that is not right, report it to support@gocertly.com. We acknowledge your report, fix it as quickly as we can and take no legal action against researchers who report in good faith and do not access or alter other people's data.

Questions?

Want more detail, a signed data processing agreement or help with a questionnaire from your client? Email support@gocertly.com.