Trust Center
Security, privacy and compliance at Certin
Everything a legal, security or procurement team needs to assess Certin, and everything our customers need to keep their own compliance records up to date.
At a glance
Stored in the European Union
Application, database, cache and file storage run in the EU region of our hosting provider. No copy of personal information is kept outside Europe.
No model training on your data
Our agreements prohibit AI providers from using customer information to train or improve their models.
A person approves what matters
Any action capable of significantly affecting someone requires human approval. That control cannot be switched off.
Multi-factor authentication enforced
MFA is required for customer organisations, with role-based access and remote session revocation.
Safeguarded transfers
Processing outside Europe runs under Standard Contractual Clauses and the UK International Data Transfer Addendum, backed by a written transfer assessment.
We never sell personal information
Customer data is used only to provide the platform, on the customer’s instructions.
How can we help?
Evaluating Certin
Your legal and security teams are reviewing us
You do not need an account. Request our Data Processing Agreement, ask us to complete your security questionnaire, and review the sub-processor list before you sign.
- Data Processing Agreement
- Security questionnaire
- Sub-processor list
- Record of security measures
Already a customer
You are building your compliance records
Request the documents your records of processing, audits and vendor reviews need. We keep these current and send them on request.
- Executed DPA and its annexes
- Record of technical and organisational measures
- Transfer safeguards and transfer assessment
- Record of the providers that carried your data
- Notification when the sub-processor list changes
Documents
Public documents open directly. Documents marked “On request” are sent to your work email after a short check.
- View
Privacy Policy
PublicWhat we do with personal information, why, and the rights people have.
- View
Terms of Use
PublicThe terms governing use of the Certin website and platform.
- View
Sub-processor list
PublicHosting location and every provider we use, with its role, the data concerned and where it processes.
- View
GDPR compliance
PublicHow Certin meets its obligations under the GDPR as processor and controller.
- View
Security overview
On this pageHow we host, encrypt, control access to and monitor the platform.
Data Processing Agreement
On requestOur DPA, including the Standard Contractual Clauses and UK Addendum where they apply.
Security questionnaire
On requestWe complete your organisation’s questionnaire, or send our standard responses.
Technical and organisational measures
On requestOur written record of the security measures in place, shared with customers and prospective customers.
Transfer safeguards and assessment
On requestThe contractual safeguards we rely on for processing outside Europe, and our assessment of the destination laws.
Security overview
A summary of the measures that protect the platform and the information in it. Our full record of technical and organisational measures is available on request.
Hosting and data residency
- Hosted on Google Cloud Platform in the European Union
- Application, database, cache and file storage all run in the EU region
- Separate environments for development and production
Encryption
- All connections to the platform are encrypted in transit
- Data is encrypted at rest
- Passwords are stored hashed, so they cannot be read
Identity and access
- No open sign up: access is granted on request and provisioned by us or the customer’s administrator
- Multi-factor authentication required for customer organisations, and cannot be bypassed by reusing an old sign in
- Role-based access, with administrators able to end any session remotely
Certin staff access
- Access to customer information is limited to a small, named group and is recorded
- Staff sign a security policy and an AI use policy before receiving any access
- Read-only access to customer systems, within the scope the customer authorises, through named individual credentials
Logging and monitoring
- Security and deletion events are logged
- Serious security events alert an administrator automatically
- Changes are audited, with audit retention configurable per customer
Artificial intelligence safeguards
- Only what the task requires is sent to AI providers, with identifying details reduced or replaced where possible
- Providers may not train on customer content
- Every automated action passes a policy control, and significant actions need human approval
- Generated content is marked as generated
Incidents
- Affected customers are told without undue delay
- Authorities and affected individuals are notified where the law requires it
Retention and deletion
- Customers control the retention of their operational records
- Expired sessions and tokens are removed by a daily job
- Account deletion removes linked personal information in one operation, and the deletion is recorded
Request documents
Tell us who you are and what you need. We reply to your work email.
Contact
Privacy and data protection
privacy@getcertin.aiSecurity, including reporting a vulnerability
security@getcertin.aiLegal
legal@getcertin.ai