You trust Certigence with your company's ESG data. This page explains, in plain language, how we protect it — and links to the documents compliance teams usually ask for.
All traffic between your browser and Certigence is encrypted with HTTPS/TLS, delivered through Cloudflare's global network.
Passwords are hashed with scrypt using a unique salt per account and verified with timing-safe comparison. Passwordless magic-link sign-in is available, so you never have to store a password with us at all.
State-changing requests are protected against CSRF, authentication and API endpoints are rate-limited, and all user input is validated server-side with strict schemas.
Role-based access control separates administrator, company and user permissions. Sessions use httpOnly, secure, sameSite cookies and are rotated after sign-in.
Payments are processed by Stripe, a PCI DSS Level 1 certified payment provider, using Stripe's hosted checkout. Your card details never touch Certigence servers.
Certigence runs on Railway and is delivered through Cloudflare. We work with a small, vetted set of subprocessors, each bound by a data processing agreement.
Certigence is built for the EU market and processes personal data in line with the GDPR. Our Privacy Policy describes what we collect and why, and how to exercise your data subject rights. A Data Processing Addendum is available for customers who process personal data through the platform, and our subprocessor list discloses every third party involved — including their location and, where applicable, the Standard Contractual Clauses covering EU–US transfers.
If you believe you have found a vulnerability or have a security question our documentation doesn't answer, please contact us. We read every report.
Anwendung und Datenbank laufen bei Railway, das in unserer Liste der Unterauftragsverarbeiter mit Standort USA geführt wird; Übermittlungen zwischen EU und USA sind durch Standardvertragsklauseln abgedeckt. Der Datenverkehr läuft über das Netzwerk von Cloudflare.
Single Sign-on mit SAML 2.0, OAuth 2.0 oder OpenID Connect ist im Enterprise-Tarif verfügbar; nennen Sie uns Ihren Identity Provider. Zwei-Faktor-Authentifizierung ist für Endnutzer noch nicht verfügbar; die passwortlose Anmeldung per Magic Link schon.
Certigence verfügt derzeit weder über einen SOC-2-Bericht noch über eine ISO-27001-Zertifizierung. Kartenzahlungen wickelt Stripe ab, das nach PCI DSS Level 1 zertifiziert ist.
Ja. Senden Sie Fragebogen oder AVV an [email protected]. Unsere Antworten stützen sich auf die auf dieser Seite und in der Liste der Unterauftragsverarbeiter beschriebenen Maßnahmen.