Trust and security
How CertAscent protects your data, who processes it for us, and where to find what your security or procurement team needs. We state facts and do not claim certifications we do not hold: CertAscent has not been audited against SOC 2 or ISO/IEC 27001.
Security overview
- Tenant isolation. Row-level security is forced on every tenant table; the application reaches tenant data only through a database role that cannot bypass it.
- Sign-in. Passkeys by default, authenticator-app codes and recovery codes, a check of new passwords against known breaches, throttling and lockout, short sessions (idle 7 days, absolute 30 days) and a fresh confirmation for sensitive actions.
- Encryption. HTTPS with HSTS. Authenticator secrets, phone numbers and other sensitive fields are additionally encrypted with AES-256-GCM, passwords are hashed with argon2id, and database backups are encrypted with a post-quantum age key before they leave our infrastructure.
- Audit and monitoring. A security audit log, a tamper-evident audit trail per organization that can be exported and verified, alerting on errors and abuse, and detection of tampering with the files we serve.
- Staff access. The admin console needs an allow-listed account, a second factor and a recent confirmation; every view and action is recorded, and credentials are never viewable.
- Hardening. Outbound connections are limited to an allowlist, a strict content security policy runs without inline scripts, and the server runs as a non-root process in a minimal container.
- Vulnerability management. Our patch targets: critical or actively exploited issues mitigated within 24 hours and fixed in 24 to 72 hours, high within 7 days, medium within 30 days.
- No tracking. No analytics, advertising or third-party scripts in the app or on this site.
- Payments. When paid plans are available, card payments are handled by our merchant of record, Paddle; card data never reaches CertAscent.
Where your data lives
The application runs in Frankfurt, Germany, the database is hosted in Frankfurt on Amazon Web Services infrastructure, and the encrypted off-site backups are stored in an EU storage jurisdiction. Some providers below are US companies; the transfer mechanisms are set out in our data processing agreement.
Daily encrypted off-site database backups run in addition to the database provider's own history. We do not publish recovery-time or uptime guarantees on this page: a service level agreement is available on request (see below).
Subprocessors
Providers that may process personal data on our behalf, and what they do. For payments, Paddle acts as an independent merchant of record when paid plans are available.
- Fly.io Application hosting and background jobs.Frankfurt, Germany
- Neon Managed PostgreSQL database, the system of record, on Amazon Web Services.Frankfurt, Germany (AWS eu-central-1)
- Cloudflare DNS, TLS and caching at the network edge, the Turnstile bot check on sign-in and contact forms, and storage of the encrypted database backups.Global network; backups in the EU jurisdiction
- Postmark Transactional e-mail such as confirmations, security notices, invitations and replies.United States
- Anthropic AI features (Cert Coach, Study Notebook), only when a member uses them; personal data is redacted first.United States
- Better Stack Uptime monitoring and this status page. It monitors public addresses and receives no customer data; people who subscribe to incident updates give their e-mail address to Better Stack directly.Region to be confirmed
- Google Workspace Mailboxes that receive support, privacy and security correspondence.Region to be confirmed
AI governance
AI features (Cert Coach, the AI tutor and the Study Notebook) use Claude models from Anthropic, and only when a member uses them. We do not claim these features are always right.
- What is sent. A member's question after e-mail addresses, phone numbers, card and ID numbers and secrets are removed, the minimal plan details Cert Coach needs, and the notebook sources the member chose. Notebook web links are fetched by Anthropic, not by our server.
- Retention. Cert Coach conversations are deleted after 30 days, and members can delete them sooner.
- Human oversight. The assistant never changes a plan by itself: a proposed change takes effect only when the member reviews it and applies it.
- Organization controls. An organization owner can turn AI features off for the members the organization manages, and can separately turn off web links as notebook sources. Changes are recorded in the organization's audit trail.
- Testing. An automated suite of 173 cases, 519 runs across the three AI modes, checks our safeguards against prompt injection, out-of-scope requests and ungrounded answers. A fresh evaluation against the live models is pending.
Report a vulnerability
Report security issues privately. The security policy explains the scope, safe-harbour terms and what to expect, including our acknowledgement and assessment times.
Documents on request
Organizations evaluating CertAscent can ask us for these. Ask through the sales contact and say which you need.
- Service level agreement (SLA). Availability, support response targets and service credits, offered with Enterprise plans.
- Data processing agreement (DPA). Our GDPR Article 28 terms, with the security measures and subprocessor annexes.
- AI governance statement. Which features use which model, what data is sent, retention, organization controls, evaluation and incident handling.
- Accessibility Conformance Report (ACR). A report in the WCAG 2.2 format. It is a draft: it is not a conformance claim until assistive-technology testing is complete. See the accessibility statement.