.svg){kind=icon}
We're happy to walk through our security practices with your team. No sales pitch, just honest answers.
SOC 2 Type II
Via Vanta
ISO 17024
Aligned workflows
GDPR
Compliant
Least privilege access
Access is limited to those with a legitimate business need, and granted based on the principle of least privilege.
Defense in depth
Security controls are implemented and layered according to the principle of defense in depth.
Applied to all
Security controls are applied consistently across all areas of the enterprise.
Transparent by default
Controls are iteratively adapted for effectiveness, auditability, and reduced friction.
.svg){kind=icon}
Customer PII (necessary for certification delivery)
Credit card information
Personal health information
Azure
Cloud Platform
Hosted on Microsoft Azure with enterprise-grade physical security, network controls, and Azure's own compliance certifications.
US
Data Hosting
Data is hosted in the United States on Azure's secure infrastructure, with the physical and logical protections of a Tier 1 cloud provider.
24/7
Global Availability
Certiverse is accessible around the clock, so your candidates and administrators can work whenever and wherever they need to.
Static analysis (SAST)
Code is automatically analyzed during pull requests and on an ongoing basis to catch security issues before they reach production.
Supply chain security
Malicious dependency scanning prevents the introduction of malware into our software supply chain, and software composition analysis (SCA) identifies known vulnerabilities in third-party components
External attack surface
External attack surface management (EASM) runs continuously to discover new external-facing assets and network vulnerability scanning runs on a periodic basis.
Endpoint protection
All corporate devices are centrally managed with mobile device management software and anti-malware protection. We enforce disk encryption, screen lock configuration, and automatic software updates. Endpoint security alerts are monitored 24/7/365.
- MDM
- 24/7 monitoring
Identity and access management
Certiverse uses Okta to secure internal identity and access management, enforcing phishing-resistant authentication factors with WebAuthn wherever possible. Employee access is role-based and automatically deprovisioned upon termination.
- Okta
- WebAuthn
Security education
All employees complete comprehensive security training upon onboarding and annually through Vanta's platform. New engineers attend a mandatory session on secure coding practices. Our security team shares regular threat briefings across the company.
- Ongoing training
Vendor security
We use a risk-based approach to evaluate vendors, assessing factors such as data access, production integration, and potential impact. Each vendor's inherent risk is rated, security is evaluated, and a residual risk rating determines the approval decision.
- Risk-based review
SOC 2 Type II
Certiverse is implementing the SOC 2 Type II framework through Vanta's compliance platform, demonstrating our adherence to the Trust Services Criteria for security, availability, and confidentiality. The process is managed through continuous monitoring and validated by an independent third-party auditor.
ISO/IEC 17024 alignment
Our platform workflows are designed to align with ISO/IEC 17024 requirements for personnel certification bodies. This means your certifications follow internationally recognized standards for competence assessment and credentialing.
GDPR compliance
We comply with the EU General Data Protection Regulation, including data subject rights, lawful processing, and data minimization. A standard Data Processing Agreement (DPA) is available, along with our full list of subprocessors.
Privacy Shield
Certiverse maintains an active Privacy Shield agreement, providing an additional framework for data protection when handling personal data transferred between jurisdictions.
Microsoft Azure
Data hosting
Auth0
Identity management
Stripe Payments
Payment collection
Sendgrid
Email delivery
Privacy Policy
Our complete privacy policy covering data collection, processing, and your rights.
Data Processing Agreement
Standard DPA for GDPR compliance, ready to review and sign
Subprocessor List
A complete list of the third-party services that process data on our behalf