Privacy Policy - CertAssist

Last updated: 31 August 2026

This Privacy Policy explains how CertAssist ("CertAssist", "we", "us") collects, uses, shares and protects personal information when you use our website and platform. If you have any questions, email us at contact@certassist.io.

Who we are

CertAssist provides a software platform that helps organisations work through compliance frameworks such as ISO 27001 and SOC 2 and prepare for certification. We are the data controller for the personal information described in this policy.

Information we collect

Account information you provide, such as your name, email address and organisation.
Content you add to the platform, including assessment details and evidence files you choose to upload.
Usage and technical data, such as log data, device and browser information, and actions taken in the platform, collected to keep the service secure and reliable.

How we use your information

To provide, maintain and secure the platform and your account.
To authenticate you, including through multi-factor authentication.
To provide support and respond to your enquiries.
To improve our products and understand how the service is used.
To send you service-related communications.
To meet legal, regulatory and security obligations.

We do not sell your personal information, and we do not use it for advertising.

Legal bases

Where the GDPR or similar laws apply, we rely on the following legal bases: performance of our contract with you, our legitimate interests in operating and improving the service, your consent where required, and compliance with legal obligations.

Service providers

We use a small number of trusted providers to run CertAssist, including cloud hosting (Google Cloud and Firebase), our payment processor for subscriptions, and an email provider. These providers process information on our behalf under appropriate agreements.

Security

We protect your information with encryption in transit and at rest, mandatory multi-factor authentication, and role-based access controls. Importantly, CertAssist does not connect to or pull data from your systems, which reduces the ways your information can be exposed. See our Security page for more.

Data retention

We keep your information for as long as your account is active or as needed to provide the service. You can ask us to delete your data, and we will do so unless we are required to keep it for legal reasons.

International transfers

Your information may be processed in the locations where our infrastructure and providers operate. Where information is transferred across borders, we take steps to ensure it remains protected.

Your rights

Depending on your location, you may have the right to access, correct, delete or export your personal information, and to object to or restrict certain processing. To exercise these rights, email contact@certassist.io.

Cookies

Our website uses only essential cookies needed to make the site and platform work. We do not use advertising or tracking cookies.

Changes to this policy

We may update this policy from time to time. We will post the updated version here and change the date above.

Contact

For any privacy question or request, email contact@certassist.io.