Security
How we protect your data
Certack is a security product — we hold ourselves to a higher standard than most SaaS applications. This page explains the controls we use to protect your monitoring data, credentials, and infrastructure.
Encryption in transit and at rest
All data transmitted between you and Certack uses TLS 1.2 or higher. Sensitive credentials (DNS provider tokens, API keys, webhooks) are encrypted at rest with AES-256-GCM using keys derived from your account's ENCRYPTION_SECRET. Plaintext credentials are never logged or returned by the API.
Secure infrastructure
Certack runs on hardened infrastructure hosted on Cloudflare Workers (application) and Supabase (Postgres database). Database access is restricted to service-role keys that are rotated regularly and never exposed to client bundles. The application is served from Cloudflare's global edge network.
Principle of least privilege
Service-role credentials used for database access are scoped to specific tables and operations. API keys (sp_*) are hashed before storage and can be revoked at any time. Internal admin endpoints require a CRON_SECRET bearer token verified with constant-time comparison to prevent timing attacks.
Webhook signatures
Every outbound webhook delivered to your endpoints is signed with HMAC-SHA256 using your WEBHOOK_SIGNING_SECRET. Recipients should verify the X-Webhook-Signature header (format: sha256=<hex digest>) before processing payloads to prevent spoofing and replay attacks.
Compliance and auditing
Certack is designed to meet GDPR and CCPA requirements. We maintain a data processing agreement (DPA) available on request. SOC 2 Type II certification is on our roadmap for enterprise customers. Audit logs of administrative actions are retained for 90 days.
Incident response
In the event of a data breach affecting your personal data, we will notify affected users within 72 hours of discovery, in line with GDPR Article 33. Notifications include a description of the breach, types of data affected, and mitigation steps. Our incident response runbook is tested quarterly.
Security controls at a glance
A summary of the technical and organizational measures in place.
| Area | Control |
|---|---|
| Data in transit | TLS 1.2+ enforced; HSTS enabled |
| Data at rest | AES-256-GCM for sensitive fields; provider-managed disk encryption |
| Authentication | OAuth (GitHub) + email/password with bcrypt hashing |
| Authorization | Row-level checks against authenticated user id; service-role keys isolated |
| API authentication | Bearer tokens (sp_ prefix), hashed at rest, revocable |
| Rate limiting | Per-IP and per-API-key limits; in-memory by default, Upstash Redis in production |
| Webhook delivery | HMAC-SHA256 signed; retry with exponential backoff |
| SSRF protection | All outbound HTTP from monitoring code validates public-IP-only targets |
| Dependency scanning | Automated pnpm audit + Dependabot on every push |
| Source-code review | All changes reviewed via pull request; CI runs lint, type-check, and tests |
| Backup retention | Supabase automatic daily backups with 7-day retention |
| Sub-processors | Supabase, Cloudflare, Creem, Resend, Upstash — all under DPA |
Responsible disclosure
We welcome security research and responsible disclosure. If you believe you have found a vulnerability in Certack, please email security@staging.certack.com with a detailed report and reproduction steps. We commit to:
- Acknowledge your report within 2 business days
- Provide a status update within 5 business days
- Remediate confirmed high-severity issues within 30 days
- Public credit for valid reports (with your consent)
Please do not test by accessing other customers' data, performing denial-of-service attacks, or social engineering our staff. We will not pursue legal action against researchers who act in good faith and comply with the policy above.
For security inquiries, DPA requests, or compliance questionnaires, contact security@staging.certack.com. For general support, see the Contact page.