Security & data protection

Compliance data deserves compliance-grade security

The system that decides whether your vendors are insured is built so its own answers can be trusted — and proven.

TLS 1.3 in transitEncrypted at restTwo-step staff accessAppend-only audits
Deep dives

Explore each layer in detail

Three topics security reviewers ask about most, each on its own page.

Tenant isolation

How the database keeps every workspace, file and vendor link separate.

Explore tenant isolation

Masked W-9 TINs

How tax IDs are masked and W-9s collected without email attachments.

Explore masked w-9 tins

Record retention

Append-only audit history, locked payment records and audit packages.

Explore record retention

Workspace isolation, enforced by the database

Your data is separated from every other customer at the database level — not by application code that could have a bad day.

  • Every table carries row-level security policies keyed to your workspace
  • A bug in any screen still cannot read another workspace's rows
  • Vendor portals use revocable, token-checked links — no shared accounts
  • Demo data is hardcoded in the app and never touches real records

Sensitive data minimized by design

We store the least sensitive version of everything — and never the part that can hurt you.

  • W-9 tax IDs are stored masked — only the last four digits are ever shown
  • Documents live in private storage with workspace-scoped paths
  • Vendor links are single-purpose: an intake link can't be reused after submission
  • No vendor logins exist, so there are no vendor passwords to leak

Staff access, locked down and logged

Our own team goes through stronger checks than anyone else on the platform.

  • Staff pages require two-step verification (authenticator app) on every session
  • Staff see a 404 — not a login hint — unless fully verified
  • Every staff view of a customer workspace is recorded with who and when
  • Support impersonation is read-only, time-boxed to 30 minutes and fully audited

Append-only audit history

Compliance records only matter if you can prove what happened. Ours can't be quietly edited.

  • Every approval, override, email and settings change is written to an append-only log
  • Not even staff can modify or delete audit entries
  • Full audit packages export as ZIP for owners, auditors and lenders
  • Document history is kept for the period your plan includes

Tamper-evident e-signatures

Lien waivers signed through myCertGate carry a verifiable record designed to hold up.

  • Signatures capture signer, timestamp and document content at signing time
  • Any change to a signed waiver after the fact is detectable
  • Built to align with ESIGN and UETA electronic-signature requirements
  • Each waiver is tied to its invoice, so the paper trail is complete

Encryption and transport security

Data is protected in motion and at rest, using the managed cloud platform's controls.

  • All traffic served over TLS 1.3 — nothing travels unencrypted
  • Documents and databases encrypted at rest
  • Payment-hold rules are enforced by the database itself, not the screen
  • AI document reads run on our managed infrastructure — files never leave it
Our promises

Three things we simply don't do

We never sell or share your data with third parties

No automatic emails — every send is a human click (unless you opt in to Auto Alerts)

Your records are exportable at any time — your data is yours

Questions?

Ask us anything about security

Completing a security review or vendor questionnaire? Send us your questions and our team will answer them.

Start free trial Contact us about security