Your workforce data,
protected by design.
CertVault holds certifications, medicals, visas and contact details for workers in high-compliance industries. That is sensitive data, and we treat it that way. Here is exactly how it is protected — in plain English, with no claims we cannot back up.
Encrypted in transit and at rest
Every connection is forced to HTTPS/TLS with HSTS (preload). Database and file storage are encrypted at rest with AES-256 via Supabase on AWS.
Row-level data isolation
Postgres row-level security means each account can only read its own rows. Cross-user views expose non-sensitive fields only; contact details unlock solely through an active hiring relationship.
Every upload is malware-scanned
Files are scanned for malware before they are ever served. Anything flagged is deleted from storage immediately and never reaches an employer.
Privacy by design
Built to GDPR, UK GDPR, the Australian Privacy Act and CCPA. Special-category health documents require explicit, timestamped consent before upload.
You stay in control
Download a structured export of your data anytime, or delete your account in one step. Deletion is symmetric — it removes both sides of every relationship.
Two-factor authentication
Add a second step at sign-in with an authenticator app (TOTP). Turn it on from your profile in seconds — sign-in then requires a one-time code, with backup codes for recovery if you lose your device.
Hardened by default
Strict security headers on every route — frame-blocking, MIME-sniff protection, a locked-down Content-Security-Policy, and global rate limits on sensitive endpoints.
One worker cannot see another
Isolation is enforced in the database itself with Postgres row-level security, not just in application code. Even if a request slipped past the app layer, the database would still refuse to return another account's rows.
- Each account can read only its own full record. There is no policy that lets one user query everyone.
- When employers browse the talent pool, they see a privileged view that exposes only non-sensitive fields. Email, phone, contact links, CVs and internal flags are physically excluded from it.
- A worker's contact details unlock only after an active hiring relationship or an accepted contact request — a rule checked inside the database, not assumed by the front end.
- Document downloads use short-lived signed links (expiring in about a minute) and are re-checked against the relationship on every request.
- When a worker is offboarded, the former employer's access to their files is revoked immediately.
Roles for Worker, Employer and Admin are separated throughout. See the Privacy Policy for what each side can and cannot see.
Nothing infected ever reaches an employer
Every file is scanned for malware before it can be viewed. We support PDF, JPG, PNG and HEIC uploads up to 10 MB each.
- Uploads are checked against VirusTotal's threat intelligence the moment they land.
- If a file is flagged as malicious, it is deleted from storage straight away and the document is marked infected — it is never shown to an employer.
- Scan activity is rate-limited per user to prevent abuse.
Worth knowing: scanning means files are shared with our malware-scanning sub-processor, which may retain them. We disclose this up front and ask for explicit consent before any sensitive health document is uploaded. Full detail is in our Document Handling policy.
Locked down end to end
- In transit: all traffic is HTTPS/TLS, enforced by HSTS with a one-year max-age, subdomain coverage and preload.
- At rest: the database and uploaded files are encrypted with AES-256 by Supabase on AWS.
- Sessions: authentication uses secure, same-site cookies that are cleared when you close your browser unless you opt into “remember me”.
- Security headers on every route:
X-Frame-Options: DENY,X-Content-Type-Options: nosniff, a strict referrer policy, a restrictive Permissions-Policy, and a Content-Security-Policy that blocks framing and untrusted script origins. - Global rate limiting (shared across every server instance) guards password resets, document scans and other sensitive endpoints.
Compliance you can act on
Our privacy programme is built around GDPR, UK GDPR, the Australian Privacy Act 1988 and CCPA/CPRA. The rights below are real buttons and flows in the product, not just policy text.
- Access & portability: download a structured export of your data from your dashboard at any time.
- Erasure: delete your account in one confirmed step. Files are removed from every storage bucket, and two-sided records are wiped on both sides.
- Consent for health data: medical and immunisation records are special-category data and require explicit, timestamped consent before upload, which you can withdraw.
- Documented retention: we publish exactly how long each category of data is kept.
Details: Privacy Policy, Data Retention and Data Processing Agreement.
Who else touches your data
We use a short, named list of established providers. Each is bound by a written agreement with equivalent data-protection obligations, and we give 30 days' notice before adding a new one.
| Provider | Location | Purpose |
|---|---|---|
| Supabase, Inc. | USA (AWS us-east-1) | Database, authentication, and file storage |
| Vercel, Inc. | USA / Global CDN | Web hosting and serverless compute |
| Resend, Inc. | USA | Transactional email |
| Stripe, Inc. | USA / EU | Payment processing |
| Anthropic, PBC | USA | AI certificate scanning and in-app assistant |
| VirusTotal (Google LLC) | USA | Malware scanning of uploaded documents |
International transfers rely on the EU-US Data Privacy Framework, Standard Contractual Clauses and the UK IDTA. Full list and transfer mechanisms are in the DPA.
Honest about uptime
CertVault runs on Vercel and Supabase and targets calendar-month availability of 99.5% or higher, measured against those upstream providers. Our Service Level Agreement sets out that commitment, the service credits that apply if we miss it, and what is excluded. Larger accounts can also negotiate a bespoke SLA — just ask.
What we are still building
Security is never finished. We would rather tell you where we are headed than imply we are already there. These are in progress:
Nonce-based CSP
Authenticated application routes — where your account data is rendered — now run a strict per-request nonce Content-Security-Policy with no inline-script allowance. We are extending the same treatment to our public marketing pages.
Security questions, or found something?
We welcome responsible disclosure. If you believe you have found a vulnerability, or you need a signed DPA, our Standard Contractual Clauses, or a summary of our security measures for a vendor review, get in touch and we will respond.
legal@certvaultapp.comPlease report vulnerabilities privately and give us a reasonable window to fix them before any public disclosure.