Security at DocCertify

Trust is our product. This page explains, in plain language, how we protect issuers, recipients, and everyone who verifies a document — and where we're headed next. No badges we haven't earned, no vague claims.

Tamper evidence at the data level

Every credential carries a SHA-256 fingerprint of its facts (name, credential, date) — not just the file. Change one fact and verification fails; redesign the certificate and it still verifies.

Tenant isolation, enforced by the database

Every table is protected by Postgres row-level security. Your organization's data is separated from every other issuer's at the database layer, not just in application code.

API keys you can trust

Keys are generated with a cryptographic random source, stored only as SHA-256 hashes, shown exactly once at creation, compared in constant time, and instantly revocable.

Signed webhooks and encrypted transport

Payment webhooks are signature-verified before any database write. All traffic is TLS-encrypted; data is encrypted at rest by our database provider. Card numbers never touch our servers — payments run entirely on Stripe and Razorpay.

Sensitive fields stay private

Fields marked sensitive — like salary on an employment letter — are never shown on public verification pages. Recipients never need an account, and verify pages expose only the facts needed to confirm authenticity.

Audited actions

Issuance, revocation, role changes, and administrative decisions are written to an append-only audit log with who, what, and when.

Reviewed, continuously

A full code-level security review of the platform was completed in July 2026 covering authentication, tenant isolation, injection, secrets handling, file uploads, and dependencies — with zero critical and zero high-severity findings. Dependencies are audited on every release, and database security advisories are monitored through our infrastructure provider.

Where we're headed

We're early, and we'd rather show you a real roadmap than an inflated badge wall. Planned next: SOC 2 Type I readiness, single sign-on for teams, and shared-infrastructure rate limiting. When we hold a certification, you'll see it here — not before.

Subprocessors

The services DocCertify runs on, and what each one is used for.

  • VercelApplication hosting and delivery
  • SupabaseDatabase, authentication, file storage
  • StripePayments (international)
  • RazorpayPayments (India)
  • ResendTransactional email
  • AnthropicAI drafting assistance (no data used for training)
  • Cloudflare TurnstileBot protection at signup

Found a vulnerability?

We want to hear about it, and we'll respond fast. Email hello@doccertify.com with the details. We commit to acknowledging reports within 48 hours, and we will never take legal action against good-faith security research.