Privacy Policy

Effective date: 16 October 2026 · Controller: Danger Close Security Co, a for-profit business organized in New Jersey, operator of Certifly (certif.ly) · Contact: support@certif.ly

This policy describes what personal data Certifly actually collects, why, and the rights you have over it. It was written from an audit of the running system. It describes real practice, not aspiration.

1. What we collect about you, our user

Account data. Your name, email address and a stable identifier from the identity provider you sign in with. We do not run our own password database and we never see your password: authentication is delegated to Rocketbox ID (id.rocketbox.ai), operated by the same company, and we store only what it tells us about you after you sign in.

Session records. For each active session: a SHA-256 hash of the session token (never the token), the IP address the request came from, the browser user-agent string, and the expiry. These exist so you can be signed in and so an unfamiliar session is visible as one.

Invitations. The email address an invitation was sent to, the role offered, who sent it, and a SHA-256 hash of the invitation token. The token itself is never stored; it exists once, in the response to whoever created the invitation.

Organization records. Which organizations and teams you belong to, your role in each, how you came to be a member, and what has been assigned to you, including policy acknowledgements you record.

Operational records. Server logs covering requests, imports, failed connection tests and authorization decisions, kept for security, abuse prevention and debugging. Service metrics are aggregate counts and durations; they carry no names, email addresses or per-person identifiers.

AI usage records. When your organization has AI features turned on, one record per request: which feature you used, when, how many tokens it took and whether it succeeded. These records hold no text: not your question, not the answer, not the configuration that was sent.

AI chat history, only if your organization keeps it. By default your conversations with the Assistant and the Help chat are not stored: they live in your browser tab and end when you close it. If an administrator of your organization turns on chat history (Settings > AI), we store each question you ask and the answer you got, so you can return to them. Only you can read your conversations; administrators cannot, though they can turn history off, which deletes every stored conversation in the organization. Stored conversations are encrypted at rest with your organization's key.

Client-side storage. Cookies and browser storage strictly needed to sign you in, and display preferences you set yourself. The complete per-key inventory is in the Cookie & Local Storage Policy.

2. What we collect about other people, on your instructions

This is the largest category by far, and the one that makes this product different from an ordinary web application. When you connect Google Workspace, Google Cloud, Okta, OneLogin, Microsoft Entra ID, GitHub, Slack or Amazon Web Services, we import their configuration so it can be audited. That configuration describes people.

Concretely, imported records can contain:

names, usernames and email addresses of accounts in the systems you connect
group and team membership, organizational-unit paths, and administrative roles
security posture per account: whether multi-factor authentication is enrolled, which factors, whether the account is suspended or active, when it last signed in
device records including serial numbers, assigned user and enrollment state
OAuth grants, API tokens and keys (their metadata and scopes, never their values), and who holds them

We also build an identity graph that correlates accounts across those systems into one person, anchored on email address and provider user id. That is the product working as intended: an audit that cannot tell one person's four accounts apart from four people cannot answer the questions it exists to answer. It is also, unambiguously, personal data about people who never signed up here.

You are the controller for all of it. See section 6.

3. Credentials we hold for you

To import from a provider we hold the credential you supply: an API token, an OAuth client secret or refresh token, a private key, or a service-account key. Every one is sealed with AES-256-GCM under a per-integration data key, itself wrapped by a key-encrypting key that lives outside the database. The interface never displays a stored credential; it shows at most three characters from each end so you can tell whether a value is the one you meant to rotate.

An AI provider key your organization saves (section 7) is held the same way: sealed under a data key belonging to your organization, tested before it is stored, and shown afterwards only by that three-character mask.

4. What we do not collect

No analytics, product telemetry, session recording or heatmaps.
No advertising trackers, tracking pixels or cross-site identifiers.
No third-party JavaScript of any kind. Payment is taken by sending you to Stripe's own pages and back; no Stripe script runs here, and no payment form is ever rendered by this service.
We do not sell or share personal information, as those terms are defined by the CCPA/CPRA and other U.S. state privacy laws.

And no exception. Every typeface is served from this domain, so the interface makes no request to any third party at all: not for fonts, not for scripts, not for anything. This is enforced rather than intended: the Content-Security-Policy permits no external origin, so a font reintroduced from somewhere else would be refused by your browser rather than quietly loaded.

5. Why we use it

We use your account, session and organization data to sign you in, show you your organizations, enforce who can do what, bill paid plans, and keep the service secure. We use imported data only as described in section 6. We do not use any of it for advertising, and we do not build profiles of you for any purpose other than running the service.

6. Our role: processor, not controller

For everything in section 2 (the configuration and identity data imported from the systems you connect), you are the controller and we are your processor. We process it only to operate the service on your instructions: to render it, version it, evaluate audit rules against it, and show you the results.

AI features are the one further use, and only if an administrator of your organization turns them on; they are off until then. When on, the configuration, findings, rules and documents a feature needs to answer a request are sent to a language model for that request alone. By default that model is one we operate on our own infrastructure: your data does not leave us to reach it. Credentials you supplied are never sent. If your organization also keeps chat history, the Assistant and Help conversations its members have, including answers that quote that data, are stored as described in sections 1 and 11, on the same instructions and under the same terms as the rest of it.

You are responsible for having a lawful basis to put that data here, and for telling the people it describes, where your law requires it. We do not use it to train anything, we do not aggregate it across customers, and no other customer can reach it. A formal Data Processing Agreement is an open item.

7. Where your data goes

Outbound connections this service makes, and what each receives:

DigitalOcean (digitalocean.com): our hosting provider. The service and its database run on DigitalOcean infrastructure in New York City, so everything described in this policy is stored there. DigitalOcean is a processor acting on our instructions.
The providers you connect (Google, Okta, OneLogin, Microsoft, GitHub, Slack, Amazon Web Services): receive the credential you supplied and the API calls needed to read configuration.
Rocketbox ID (id.rocketbox.ai): the identity provider that authenticates you, operated by the same company.
Resend (resend.com): the address and content of invitation emails, only when an invitation is sent.
Stripe (stripe.com): our payment processor, and only for an organization on a paid plan. It receives the billing contact's email address, the organization name, an internal organization identifier, and the usage counts a usage-priced plan is billed on. Card details are entered on Stripe's own pages and never reach this service. Stripe is a processor acting on our instructions and is also a controller for its own fraud-prevention and regulatory purposes; see stripe.com/privacy.
An external AI provider, only if you choose one. AI requests go to a model we operate ourselves (see section 6). The one exception is an organization whose administrator saves its own AI provider key: that organization's requests go directly to that provider, under that key and your agreement with them, and to no one else.
Notification destinations you configure: webhooks or Slack endpoints receive finding summaries. You choose these; we do not.

The usage counts sent to Stripe are numbers, not names: how many distinct people your connected systems know about, and how many systems you have connected. No identity, address or attribute of any of those people is sent.

The server refuses to connect to private, loopback or link-local addresses, so a misconfigured destination cannot be used to reach the infrastructure this runs on.

Contract: account data, session cookies, organization membership, billing.
Legitimate interests: operational logging, abuse prevention, service integrity, and AI usage records (to attribute use to the organization that made it and to prevent abuse).
Your instructions as controller: everything imported from the systems you connect (section 2), and sending that data to a language model, which happens only after an administrator of your organization turns AI features on (section 6).

You can ask us to give you a copy of the personal data we hold about you, correct it, erase it, restrict our processing of it, export it in a machine-readable form, or object to processing based on legitimate interests. We make no automated decisions with legal or similarly significant effects about you. AI features produce drafts and answers for a person to read; nothing they produce takes effect until someone accepts it. If your organization keeps chat history, you can delete any of your own saved conversations yourself, at any time, from its History.

Email support@certif.ly. We respond within one month. You may also complain to your supervisory authority.

If you are one of the people described in imported configuration rather than a user here, your rights sit against the organization that connected the system, because they are the controller. Ask us and we will point you to them and assist them in answering you.

10. U.S. state privacy rights (including California and New Jersey)

Residents of California, New Jersey and other U.S. states with comprehensive privacy laws may have the right to know what personal data we collect (this policy is that disclosure), to access it, correct it, delete it, receive a portable copy, and opt out of its sale, of targeted advertising, and of profiling. We do not sell personal data, use it for targeted advertising, or profile anyone, so there is nothing to opt out of; if that ever changes we will provide a mechanism before it does.

Send requests to support@certif.ly. We will verify the request, answer within the time the applicable law sets (45 days, extendable where the law allows), and, if we decline, tell you why and how to appeal. We will not discriminate against you for exercising any of these rights. Many of these laws do not apply to data processed in a business or employment context, which is most of what Certifly handles; we honor the requests anyway where we can.

11. Retention

Account and membership data: for the life of the account.
Sessions: until they expire (seven days) or you sign out. Invitations: seven days, then they stop working; the record is kept as the trail of who was let in.
Imported configuration: kept as history on purpose. Versioning every import is the product: "when did this change, and to what" is the question it exists to answer, and that requires keeping superseded versions. Deleting an integration removes its imported data.
Credentials: until you replace or disconnect them.
AI requests: the text of a request and its answer is not stored, with one exception: if your organization keeps chat history, your Assistant and Help conversations are kept until 90 days after their last message, until you delete them, or until an administrator turns history off, whichever comes first. A draft becomes part of your data only if somebody saves it. The usage record of each request (section 1) is kept for the life of the organization; if a person's account is deleted, their records stay counted against the organization without their name.

12. Security

Credentials are sealed at rest. Session and invitation tokens are stored only as SHA-256 hashes. The database connection is authenticated as well as encrypted (verify-full). Cookies are HttpOnly, Secure and SameSite=Lax. Access is permission-checked per request and scoped to one organization. No system is entirely secure; if a breach affects your personal data we will notify you and, where required, the relevant authority, within the time the applicable law requires (72 hours under GDPR art. 33).

13. International transfers

The service is hosted in the United States (DigitalOcean, New York City). If you access it from the EU, EEA or UK, your data is transferred to and processed there. The transfer mechanism is an open item.

AI requests are processed on the same infrastructure. The exception is an organization that saved its own AI provider key: its requests are processed wherever that provider processes them, under that organization's agreement with it.

14. Children

This is a workplace administration tool for businesses. It is not directed to children under 16 and we do not knowingly collect their data.

15. Changes

Material changes will be announced in the product before they take effect, and the effective date above will change. The Terms of Service and the Cookie & Local Storage Policy are read together with this policy.