Security at DocCertify
Trust is our product. This page explains, in plain language, how we protect issuers, recipients, and everyone who verifies a document — and where we're headed next. No badges we haven't earned, no vague claims.
Tamper evidence at the data level
Every credential carries a SHA-256 fingerprint of its facts (name, credential, date) — not just the file. Change one fact and verification fails; redesign the certificate and it still verifies.
Tenant isolation, enforced by the database
Every table is protected by Postgres row-level security. Your organization's data is separated from every other issuer's at the database layer, not just in application code.
API keys you can trust
Keys are generated with a cryptographic random source, stored only as SHA-256 hashes, shown exactly once at creation, compared in constant time, and instantly revocable.
Signed webhooks and encrypted transport
Payment webhooks are signature-verified before any database write. All traffic is TLS-encrypted; data is encrypted at rest by our database provider. Card numbers never touch our servers — payments run entirely on Stripe and Razorpay.
Sensitive fields stay private
Fields marked sensitive — like salary on an employment letter — are never shown on public verification pages. Recipients never need an account, and verify pages expose only the facts needed to confirm authenticity.
Audited actions
Issuance, revocation, role changes, and administrative decisions are written to an append-only audit log with who, what, and when.
Reviewed, continuously
A full code-level security review of the platform was completed in July 2026 covering authentication, tenant isolation, injection, secrets handling, file uploads, and dependencies — with zero critical and zero high-severity findings. Dependencies are audited on every release, and database security advisories are monitored through our infrastructure provider.
Where we're headed
We're early, and we'd rather show you a real roadmap than an inflated badge wall. Planned next: SOC 2 Type I readiness, single sign-on for teams, and shared-infrastructure rate limiting. When we hold a certification, you'll see it here — not before.
Subprocessors
The services DocCertify runs on, and what each one is used for.
- VercelApplication hosting and delivery
- SupabaseDatabase, authentication, file storage
- StripePayments (international)
- RazorpayPayments (India)
- ResendTransactional email
- AnthropicAI drafting assistance (no data used for training)
- Cloudflare TurnstileBot protection at signup
Found a vulnerability?
We want to hear about it, and we'll respond fast. Email hello@doccertify.com with the details. We commit to acknowledging reports within 48 hours, and we will never take legal action against good-faith security research.