Security, in facts
CertiFlow is a system holding a contractor’s statutory records, and this page sets out exactly how those are protected — including what still needs to improve.
No certification badges and no hollow reassurance. What follows can be checked, and each point says where it comes from.
Passwordless login
There is no password database, because there are no passwords. You sign in with a code by email or a one-time link. A password that does not exist cannot leak and cannot be reused.
No tokens in the browser
The browser never talks to the API directly. Every request goes through the Next.js server, which holds the session; the API’s address and its tokens never reach your browser.
The logbook is immutable at database level
PostgreSQL triggers block UPDATE and DELETE on logbook rows. This is not an application rule you could bypass by calling a different endpoint: the database refuses.
Separated per company
Every query is bound to the signed-in user’s company. A manager at company A cannot retrieve company B’s data, not even by guessing an id.
Revoking sessions
A manager can revoke any active session. The session itself ends immediately; an access token already issued stays valid for at most fifteen minutes, so count on a quarter of an hour rather than a second.
Where it runs
The servers are in Germany, inside the EU. Traffic passes through Cloudflare, which terminates encryption as a reverse proxy. No data goes to countries outside the EU.
Backups — and what still needs to improve
A full database dump is taken at every deployment, and the last five are kept. That is frankly thin for a system with a five-year retention obligation, and it is top of our list: a nightly backup with a longer retention period.
Who else can reach it
Hetzner (hosting, Germany), Cloudflare (network and encryption) and our email provider, for sending login codes and notifications. Nobody else. There are no analytics, ad networks or third-party scripts in the site or the product.
Reporting a vulnerability
If you find something, email us directly. We reply within one working day, keep you posted on the fix, and credit you if you want. We take no legal action against anyone who reports responsibly.
Data processing agreement
We process personal data on your instructions, so a data processing agreement belongs with it. You can download it here and read it before signing anything, or even before getting in touch.
What we are working on
Nightly backups with a longer retention period, an independent security test, and two-factor authentication as an option for managers. As soon as something is done it moves up into the list above.
Start with your three most awkward customers
You do not have to migrate everything to find out whether this works. Put three installations in, have an engineer book a charge, and download the export. 30 days, no credit card, no automatic renewal.