You trust Certigence with your company's ESG data. This page explains, in plain language, how we protect it — and links to the documents compliance teams usually ask for.
All traffic between your browser and Certigence is encrypted with HTTPS/TLS, delivered through Cloudflare's global network.
Passwords are hashed with scrypt using a unique salt per account and verified with timing-safe comparison. Passwordless magic-link sign-in is available, so you never have to store a password with us at all.
State-changing requests are protected against CSRF, authentication and API endpoints are rate-limited, and all user input is validated server-side with strict schemas.
Role-based access control separates administrator, company and user permissions. Sessions use httpOnly, secure, sameSite cookies and are rotated after sign-in.
Payments are processed by Stripe, a PCI DSS Level 1 certified payment provider, using Stripe's hosted checkout. Your card details never touch Certigence servers.
Certigence runs on Railway and is delivered through Cloudflare. We work with a small, vetted set of subprocessors, each bound by a data processing agreement.
Certigence is built for the EU market and processes personal data in line with the GDPR. Our Privacy Policy describes what we collect and why, and how to exercise your data subject rights. A Data Processing Addendum is available for customers who process personal data through the platform, and our subprocessor list discloses every third party involved — including their location and, where applicable, the Standard Contractual Clauses covering EU–US transfers.
If you believe you have found a vulnerability or have a security question our documentation doesn't answer, please contact us. We read every report.
The application and database run on Railway, which our subprocessor list gives with location United States; EU–US transfers are covered by Standard Contractual Clauses. Traffic is delivered through Cloudflare's network.
Single sign-on with SAML 2.0, OAuth 2.0 or OpenID Connect is available on the Enterprise plan; tell us which identity provider you use. Two-factor authentication is not yet available to end users; passwordless magic-link sign-in is.
Certigence does not currently hold a SOC 2 report or an ISO 27001 certification. Card payments are handled by Stripe, which is PCI DSS Level 1 certified.
Yes. Send your questionnaire or DPA to [email protected]. Our answers are based on the controls described on this page and in our subprocessor list.