How we protect client data

1.What we hold

During an audit we see documents, records and systems that are confidential to you. We keep only what we need to support the audit report and certification decision, for as long as accreditation rules require, and treat it as confidential.

2.Access

• Staff accounts use individual sign-in, with two-factor authentication available to every user
• Access to client records is limited by role and recorded
• Administrative actions are written to a tamper-evident activity log
• Accounts are removed promptly when people leave

3.Our systems

• All traffic to our website, register and staff systems is encrypted in transit with TLS
• API keys for integrations are stored only as hashes and can be limited to read-only access
• Security headers and rate limits protect public forms and the register
• Certificates link to our register, so a forged or altered copy can be spotted by checking it online

4.Security testing engagements

For security audits we agree the scope, test windows and rules of engagement in writing before testing starts. Test accounts and credentials you give us are used only for the agreed tests, and findings are shared only with the people you name.

5.Reporting a vulnerability

If you find a security issue in our website or register, email hello@cert.solutions with the details. Please do not access data that is not yours or disrupt the service. We will acknowledge your report and keep you updated.