Security
Security at Certifyi
We run the same management system, controls and evidence discipline that we implement for customers. This page explains how we protect your data and how to report a vulnerability to us.
How we run our own programme
Certifyi is a product of Dignep Group. We operate our own audited service management system, certified to ISO/IEC 20000-1:2018, and we run the same internal audits, management reviews and evidence collection on a schedule that we ask our customers to run. If a vendor is going to manage your compliance programme, it is fair to ask what they have passed themselves.
Evidence integrity
Every file is hashed when it arrives and versioned. Evidence is withdrawn with a recorded reason rather than deleted silently, and the audit trail is chained so that tampering cannot be hidden.
Access control
Role-based access throughout, with SAML single sign-on and SCIM provisioning available. Administrative actions are logged, including sign-in attempts.
Auditors and suppliers
An auditor reaches your record only through an engagement that names the firm, the framework and a date window. Access is read-only and stops automatically when the window closes.
Connected systems
Integrations are read-only. Credentials are stored encrypted and are never shown back in the interface, and every scheduled job records when it last ran.
Reporting a vulnerability
If you believe you have found a security issue in Certifyi, please tell us before telling anyone else. Email [email protected] with “Security” in the subject line and enough detail for us to reproduce the issue.
- We review every report that reaches that address and will come back to you on what we find.
- Please do not run automated scanning or testing against customer tenants, and do not access, change or keep anyone else’s data.
- Give us a reasonable chance to fix an issue before you publish it, and we will credit you if you would like us to.
For privacy questions, data subject requests or a copy of our subprocessor list, see the privacy policy or write to the same address.
Want to see the controls behind the platform?
30 minutes with a compliance lead. Bring your security questionnaire and we will answer it with you.