Security
How we secure the platform that holds your compliance data
Certifyi stores your controls, evidence, risk registers, vendor data and activity history. This page sets out how we protect that data and where our own security programme stands today.
In short
Each customer’s workspace has its own database. Every action is written to a tamper-evident activity log. Every change to our code passes a multi-stage review that includes security. We can show you each of these in a demo.
Data isolation
A database for each customer
Each customer’s workspace has its own database. Customers are not kept apart by a customer ID column in a shared database.
Each customer runs in its own workspace, and your data region is set for that workspace. Ask us about hosting location during your evaluation and we will tell you exactly where your workspace would run.
Development practices
Multi-stage code review
Every change to our code passes a multi-stage review that includes security before it reaches customers.
Security findings from that review, and from any other source, are kept in a register until they are fixed.
Record integrity
Tamper-evident activity log
Every action in Certifyi is written to an activity log. Each entry is chained to the one before it with a hash, so an edit made after the fact can be detected.
This shows that a record has not changed since it was written. It does not show that the evidence was accurate or complete when it was collected. Reviewers and auditors still have to judge that.
Access control
Roles, multi-factor sign-in and auditor access
Role-based access control in your workspace decides who can see and change what. TOTP multi-factor authentication can be required by role.
Auditors get scoped, read-only access to the evidence for their engagement and nothing else in your workspace.
Our own programme
Where our own security programme stands
Certifyi does not currently hold ISO 27001 certification or a SOC 2 report.
We keep a register of every security finding until it is fixed. Ask us for the current status of our own programme during your evaluation.
Questions
Security questions
How is customer data isolated?
Each customer’s workspace has its own database. Customers are not separated by filtering rows in a shared database.
Where is data stored?
Your data region is set for your workspace. Ask us about hosting location during your evaluation and we will tell you exactly where your workspace would run.
Does Certifyi hold ISO 27001 or SOC 2?
Not yet. Certifyi does not currently hold ISO 27001 certification or a SOC 2 report. We keep a register of every security finding until it is fixed, and we will tell you where our own programme stands during your evaluation.
Can I check that records have not been altered?
The activity log is hash-chained. Each entry is linked to the one before it, so an edit after the fact breaks the chain. That shows a record is unchanged since it was written. It does not show that the evidence in it was accurate.
How do you handle vulnerability reports?
Report suspected vulnerabilities through our security contact. Every report is triaged and kept in our findings register until it is fixed.
See how your workspace would be set up
Book a demo and we will show you how your workspace is kept apart from other customers and how every action is recorded.