Security & trust
Your members’ records, handled the way a public agency would.
What we keep, who can see it, and how it is protected, for your IT and records teams.
At a glance
- Each agency’s records are kept apartYes
- Owner, coordinator and read-only viewer rolesYes
- Every change is in the audit log: who, what, whenYes
- Member links are private and expire after 7 daysYes
- Sign-in by emailed link, with no passwords to leakYes
- Texts follow carrier rules: STOP always works, never marketingYes
How we protect it
Six things your IT team will ask about.
Kept apart by agency
The database itself limits every request to your agency’s records, so one agency can never see another’s members. With no agency set, a request sees nothing.
Access by role
Owners manage the team and the agency’s settings. Coordinators keep the member list current. Viewers can look but can’t change anything.
Every change logged
Each change to a member’s records is written to an audit log with who made it and when. The log is append-only: an entry can’t be edited or deleted.
Private member links
Members send their cards through a private link in their reminder. It works for that member only and expires after 7 days. No account and no password to leak.
No passwords to steal
Your team signs in with a one-time link sent to their work email, so there is no CertlyPro password to guess, reuse or phish.
Texts done right
Reminders only, never marketing. A reply like STOP is accepted only when it carries Twilio’s signature, and it stops every text to that number.
Service providers
Who we share data with.
Only the companies that run parts of CertlyPro for us, under contracts that limit what they can do with it. We never sell personal information.
| Provider | What it does | What it handles |
|---|---|---|
| Vercel | Hosts the website and app | Pages and sign-in requests |
| Neon | Runs the database | Agency and member records, certifications, audit log |
| Cloudflare R2 | Stores card copies in a private bucket | Photos and PDFs of cards and certificates |
| Twilio | Sends text messages | Mobile numbers and the texts sent |
| Postmark | Sends email | Email addresses, reminder emails and sign-in links |
Questions from your IT team?
Bring them to the demo. We'll walk through how your members' records are kept.