You trust Certigence with your company's ESG data. This page explains, in plain language, how we protect it — and links to the documents compliance teams usually ask for.
All traffic between your browser and Certigence is encrypted with HTTPS/TLS, delivered through Cloudflare's global network.
Passwords are hashed with scrypt using a unique salt per account and verified with timing-safe comparison. Passwordless magic-link sign-in is available, so you never have to store a password with us at all.
State-changing requests are protected against CSRF, authentication and API endpoints are rate-limited, and all user input is validated server-side with strict schemas.
Role-based access control separates administrator, company and user permissions. Sessions use httpOnly, secure, sameSite cookies and are rotated after sign-in.
Payments are processed by Stripe, a PCI DSS Level 1 certified payment provider, using Stripe's hosted checkout. Your card details never touch Certigence servers.
Certigence runs on Railway and is delivered through Cloudflare. We work with a small, vetted set of subprocessors, each bound by a data processing agreement.
Certigence is built for the EU market and processes personal data in line with the GDPR. Our Privacy Policy describes what we collect and why, and how to exercise your data subject rights. A Data Processing Addendum is available for customers who process personal data through the platform, and our subprocessor list discloses every third party involved — including their location and, where applicable, the Standard Contractual Clauses covering EU–US transfers.
If you believe you have found a vulnerability or have a security question our documentation doesn't answer, please contact us. We read every report.
L'application et la base de données fonctionnent chez Railway, que notre liste de sous-traitants indique comme situé aux États-Unis ; les transferts UE–États-Unis sont couverts par des clauses contractuelles types. Le trafic passe par le réseau de Cloudflare.
L'authentification unique via SAML 2.0, OAuth 2.0 ou OpenID Connect est disponible avec l'offre Enterprise ; indiquez-nous votre fournisseur d'identité. L'authentification à deux facteurs n'est pas encore disponible pour les utilisateurs ; la connexion sans mot de passe par lien magique l'est.
Certigence ne dispose pas actuellement d'un rapport SOC 2 ni d'une certification ISO 27001. Les paiements par carte sont traités par Stripe, certifié PCI DSS niveau 1.
Oui. Envoyez votre questionnaire ou votre DPA à [email protected]. Nos réponses s'appuient sur les mesures décrites sur cette page et dans notre liste de sous-traitants.