Your data and privacy
This article lists every category of data Certly holds, where it is kept and how long it stays there. It also shows how to download a copy, how to erase a single supplier contact, and how to delete the account and everything in it.
What this article covers
You usually need this page for one of three reasons: a customer or your own IT team has sent you a data questionnaire, a supplier contact has asked what happens to their name and email address, or you are closing the account and want to know exactly what goes.
Everything below comes from Certly's own data handling declaration. Where a detail is not covered here, it is because the product does not state one, and you should ask us rather than assume.
What Certly stores, and why
- Your sign-in details. Your name, email address and password, stored hashed, to sign you in and keep the account yours.
- Your site's settings. Your site's name, alert settings and the wording you write for your chase emails, used to head the audit PDF, name your plant in chase emails, send them in your own words and time the expiry reminders.
- Supplier contact details. Supplier company names, contact names, contact email addresses and contact phone numbers, so each supplier's certificates can be tracked and the right person chased when one is due.
- Certificate documents. The files you or your suppliers upload, as PDF, PNG or JPEG, with their issue and expiry dates, including versions replaced by a renewal, so status can be computed, the dashboard and its PDF export built, and an auditor asking for the document that was valid on a past date answered.
- The sending account you connect. From address, mail server, sign-in name and the mailbox password or API key, encrypted before it is stored, so chase emails leave from your own mailbox.
- A log of every chase email. Recipient, time sent, delivery result and opens, so you see what was actually sent and delivered rather than assuming.
- Sign-in session records, including IP address and browser, to keep sessions secure and let you stay signed in.
- A record of the product actions you complete, such as a chase sent, a certificate uploaded or an audit PDF exported, and when you last used the app. It stays in the product's own database, no third party analyses it, and action records older than 16 weeks are deleted.
- Your subscription status, mirrored from Stripe. Card numbers never reach our servers.
You sign in with an email address and password.
Where it is kept, and for how long
Certly runs on Amazon Web Services, in the product's own Postgres database. Uploaded certificate documents sit in that same database, not in a shared file store.
Everything is kept while your account is open: expired certificates, superseded versions and chase history included, because that trail is what an auditor asks for. A renewal never deletes the document it replaces. Archiving a supplier keeps its records and stops its reminders. Supplier upload links expire on their own.
Three other services handle data on Certly's behalf: Amazon Web Services hosts the application and its database and delivers chase and upload-link emails through Amazon SES for a site that has not connected its own sending account; Stripe takes card payments, works out VAT at checkout from your billing address and VAT number, and manages subscriptions; Resend delivers chase and upload-link emails only for a site that connects a Resend account rather than its own mailbox, and reports opens back.
Take a copy, erase a contact, or delete it all
- Open Settings, then Site details
Both the data download and account deletion live on that one screen. Nothing on it changes your supplier records on its own.
- Download a JSON file of your data
The same screen downloads a JSON file of your data. Take it before you delete anything, and keep it where your audit records live.
- Erase one supplier contact if that is all you need
A supplier contact's name, email address and phone number can be erased on their own from that supplier's page, without touching the certificate records. The article on right-to-erasure for supplier contacts walks through it.
- Delete the account when you are closing it
On Settings, Site details, confirm with your email address. Your sites, suppliers, certificate documents, chase history, settings and sign-in details are removed at once, and any live subscription is cancelled.
What is not in place today
So you can answer a questionnaire honestly, these are the things Certly does not have yet:
- An independent security audit or certification, such as SOC 2 or ISO 27001.
- Single sign-on, by SAML or OIDC, and two-factor authentication.
- A standard data processing agreement ready to countersign.
- A published backup and disaster-recovery schedule.
- A choice of data residency region.
If one of these is a condition of your purchase, say so when you write to us rather than waiting for it to appear.
If this did not answer your question
Email support@usecertly.com with the question as your customer or auditor asked it, and we will answer from what the product actually does. If you were sent here to erase a supplier contact, the article on right-to-erasure covers the confirmation step and what stays behind; if you cannot sign in to reach the settings screen at all, start with the article on signing in to your Certly account.
Questions
Where is my data hosted?
On Amazon Web Services, in Certly's own Postgres database. There is no choice of data residency region today.
Are certificate documents kept in a shared file store?
No. The PDF, PNG or JPEG files you and your suppliers upload are stored in the product's own Postgres database, alongside their issue and expiry dates.
Does a renewal overwrite the certificate it replaces?
No. Versions replaced by a renewal are kept, so an auditor asking for the document that was valid on a past date can be answered.
Do you have SOC 2 or ISO 27001?
No. An independent security audit or certification is not in place, and nor is single sign-on or two-factor authentication.
Can you countersign our data processing agreement?
A standard data processing agreement ready to countersign is not in place today. Email support@usecertly.com with what your contract requires.
Does archiving a supplier delete its data?
No. Archiving keeps the supplier's records and stops its reminders. Deleting the account is what removes records, all at once.
Does deleting my account cancel the subscription?
Yes. Deleting the account from Settings, Site details removes your sites, suppliers, certificate documents, chase history, settings and sign-in details at once, and cancels any live subscription.
How long do you keep the record of what I did in the app?
Records of actions you complete, such as a chase sent or an audit PDF exported, are deleted after 16 weeks. They stay in the product's own database and no third party analyses them.