Data handling

Who holds it

Certly is run by Kaleido Ltd, a company registered in England and Wales, company number 17516332, whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. Kaleido Ltd is the controller for your own account details. For the supplier contacts and certificates your site loads, your site decides what is held and for how long, and Certly holds it on your instructions.

To ask what is held about you, or to have it erased, email support@usecertly.com.

What is stored, and why

Your name, email address and password (stored hashed)

To sign you in and keep the account yours

Your site's name and alert settings

To head the audit PDF, name your plant in chase emails and time the expiry reminders

Supplier company names, contact names and contact email addresses

To track each supplier's certificates and chase the right person when one is due

Certificate documents you or your suppliers upload (PDF, PNG or JPEG), with issue and expiry dates, including versions replaced by a renewal

To compute certificate status, build the audit-ready dashboard and its PDF export, and answer an auditor asking for the document that was valid on a past date

The sending account you connect: from address, mail server, sign-in name, and the mailbox password or API key, encrypted before it is stored

So chase emails leave from your own mailbox, which is what keeps them out of a supplier's spam folder

A log of every chase email: recipient, time sent, delivery result and opens

So you see what was actually sent and delivered rather than assuming

Sign-in session records, including IP address and browser

To keep sessions secure and let you stay signed in

A record of the product actions you complete (a chase sent, a certificate uploaded, an audit PDF exported) and when you last used the app

To see which parts of the product earn their keep and whether people come back. It stays in the product's own database, no third party analyses it, and action records older than 16 weeks are deleted

Your subscription status, mirrored from Stripe

To know which plan your site is on; card numbers never reach our servers

Where it lives

Amazon Web Services, in the product's own Postgres database. Uploaded certificate documents are stored in that same database, not in a shared file store.

How long it is kept

Everything is kept while your account is open, expired certificates, superseded versions and chase history included, because that trail is what an auditor asks for; a renewal never deletes the document it replaces. Archiving a supplier keeps its records and stops its reminders. Deleting your account removes it all at once. Upload links expire on their own.

Deletion and erasure

Delete your account from Settings, Site details, confirming with your email address: your sites, suppliers, certificate documents, chase history, settings and sign-in details are removed at once and any live subscription is cancelled. The same screen downloads a JSON file of your data first. A supplier contact's name and email can also be erased on their own from the supplier's page.

Who else touches it

Amazon Web Services

Hosts the application and its database, and delivers chase and upload-link emails through Amazon SES for a site that has not connected its own sending account

Stripe

Takes card payments, works out VAT at checkout from your billing address and VAT number, and manages subscriptions

Resend

Delivers chase and upload-link emails only for a site that connects a Resend account rather than its own mailbox, and reports opens back

Not in place yet

Things a buyer may expect that Certly does not have. They are listed so nobody has to ask.

• An independent security audit or certification (SOC 2, ISO 27001)
• Single sign-on (SAML or OIDC) and two-factor authentication
• A standard data processing agreement ready to countersign
• A published backup and disaster-recovery schedule
• A choice of data residency region