Security
A credential record is only useful if it's defensible.
HSE managers, auditors, and regulators don't care how slick a dashboard looks — they care whether the data behind it can be trusted. This page is an honest snapshot of how CertSafe protects credential data today, where we are on the path to formal certifications, and how to reach us with security questions.
How we protect your data.
Encryption everywhere
All traffic between worker apps, supervisor scanners, and the dashboard is encrypted in transit with TLS 1.2+. Credential data is encrypted at rest in our managed Postgres database.
Signed credentials
Every QR-coded credential carries a payload signed by our backend. A supervisor's phone can verify it offline; a forged or tampered QR cannot pass verification.
Role-based access
Workers see themselves. Supervisors see their crew. HSE managers see their organisation. Roles are enforced at the database layer, not just in the UI.
Tamper-evident audit log
Every credential event — add, renewal, expiry, verification, role change — is recorded on an append-only timeline that can be exported for any audit or regulator review.
PII minimisation
We store the credential data your workflow needs and nothing more. Verifiers at the gate see only the names and statuses of credentials, never the underlying medical details or government IDs behind them.
Secure software practice
All production deploys go through code review and automated tests. Dependencies are scanned for known vulnerabilities. Production secrets live in our hosting provider's secret store, never in source control.
Data residency.
CertSafe stores customer data in North American regions by default. Canadian data residency is available for customers whose regulatory posture requires it. If your jurisdiction is something else, tell us during onboarding and we'll confirm what we can offer today vs. what's on the path.
Where we are honestly.
CertSafe is early. We're not going to pretend we have certifications we don't. Here's what is in place today, what we're building toward, and what's available on request.
TLS in transit, encryption at rest, signed credentials, role-based access, tamper-evident audit log, and a clear incident-response playbook.
SOC 2 Type II is the formal certification our enterprise customers will need most. We're building toward it. We will not claim it until an external auditor has signed on the line — and we'll publish the report when they do.
SAML / OIDC single sign-on, multi-factor authentication enforcement at the organisation level, and configurable session-timeout policies. Available today on request for design-partner customers.
Reach the security team.
If you're evaluating CertSafe and need a security questionnaire filled out, or if you believe you've found a vulnerability, we want to hear from you. We aim to acknowledge security reports within one business day.
Email security@certsafe.ai with your questionnaire or due-diligence package.
Found a vulnerability? Email security@certsafe.ai with details and we'll work with you on a coordinated fix and timeline.
General questions go to hello@certsafe.ai.
Security questions
Are you SOC 2 certified?
Not yet. SOC 2 Type II is on the path; we're building toward it and will publish the report when an external auditor has signed it. We don't claim certifications we don't have.
Where is data stored?
North America by default. Canadian data residency is available for customers whose jurisdiction requires it. Tell us during onboarding and we'll confirm what we can offer today.
How is access controlled inside our organisation?
CertSafe enforces role-based access at the database layer (not just the UI). Workers see themselves, supervisors see their crew, HSE managers see the whole organisation, and you can configure additional roles as needed.
Do you support SSO and MFA?
SSO (SAML / OIDC) and organisation-level MFA enforcement are part of the enterprise plan and are available on request today for design-partner customers. For everyone else, individual users can enable MFA on their own account.
What's in the audit log?
Every credential add, renewal, expiry, and verification. Every role change. Every credential issuance from the dashboard. The log is append-only and exportable for any audit or regulator review.
What happens if you have a security incident?
We maintain an incident-response playbook covering detection, containment, remediation, and customer notification. Affected customers will be contacted directly and given a written postmortem once the incident is closed.
Can I get a copy of your security questionnaire response?
Yes. Email security@certsafe.ai with your questionnaire (SIG, CAIQ, or your own format) and we'll return it within five business days for most formats.
See how the platform works.
Read how CertSafe holds credentials, verifies at the gate, and gives HSE teams real-time workforce-readiness.