Privacy Policy
Last updated: 2026
What we collect
CertTrack stores the account information you provide (name, work email), the organization data you enter (employee names, job titles, credential records and uploaded documents), and operational metadata needed to run the product (audit logs, login timestamps, billing status). We do not use AI, OCR, or any third-party data enrichment on your content.
Tenant isolation
Every record in CertTrack belongs to exactly one organization. Data is never shared, aggregated, or made visible across organizations. Access is enforced server-side on every request, not just hidden in the interface.
Documents
Uploaded files (certificates, licenses) are stored in private object storage and are never publicly accessible. They are served only through short-lived, signed URLs to authenticated, authorized users within the same organization.
Data retention and deletion
Archived employees, credentials and documents are retained (not immediately erased) so audit history stays intact, and are excluded from active views. To request permanent deletion of your organization's data, contact your account owner or email us — we will process deletion requests in line with applicable law.
Third parties
We use payment processing (Stripe) for billing and a transactional email provider to send reminders and account notifications. These providers only receive the minimum data needed to perform their function (e.g. billing contact, email address).
Contact
Questions about this policy or your data can be sent to the contact address listed on your account owner's billing receipt.