Security, hosting, data protection and legal documents

Legal documents

The Master Software-as-a-Service Agreement is signed with each customer and is provided with your Order Form. Book a Demo to receive a copy.

Where your data is hosted

Certyze runs on Amazon Web Services in the Asia Pacific (Mumbai) region, ap-south-1: the application on Amazon Lightsail and your data in Amazon RDS. Each certification body gets its own Amazon RDS database, so one body's data sits apart from every other's at the storage layer. Production data and daily encrypted backups are configured to stay in India. Daily incremental backups cover the AWS Lightsail infrastructure and database; snapshots are also stored in Amazon S3 for backup and recovery. Backups and snapshots are retained while the certification body remains active in Certyze.

Not everything stays in India, and we would rather say so up front. Certain AWS support and telemetry services may process data elsewhere, and the providers below handle email, payments and the domain registration.

If you are in the EU or the UK

You are the controller of the data you put into Certyze, and Thinkdata Labs LLP, which provides Certyze, is your processor. India does not have an EU adequacy decision, so transfers from the European Economic Area are covered by the European Commission Standard Contractual Clauses (Implementing Decision (EU) 2021/914), Module Two, controller to processor. They are built into our Data Processing Addendum, with Irish law and courts for the clauses. UK transfers use the ICO International Data Transfer Addendum.

Where the clauses and the Addendum differ from the rest of our contract, the clauses prevail.

If you are in India

Under the Digital Personal Data Protection Act, 2023, you are the Data Fiduciary for the personal data you put into Certyze, and Thinkdata Labs LLP processes it on your behalf under our Data Processing Addendum. Customer data is hosted in Mumbai. What the DPDP Rules require of a certification body

Security controls

• Encryption. TLS for data in transit; AWS-managed encryption for databases, backups and storage at rest.
• Multi-factor authentication. Mandatory for every user, including administrators.
• Access. Role-based permissions for your users and ours. Our staff reach customer data only on a need-to-know basis, and every access is logged.
• Backups. Daily, incremental and encrypted, kept for as long as you specify during your subscription.
• Logging. Security events are logged to support detection and investigation.
• Development. Secure development practices, including code review and vulnerability management.

Certifications

If something goes wrong

If a personal data breach affects your data, we notify you without undue delay after becoming aware of it. The notice covers what happened, the data and people affected, the likely consequences and what we are doing about it, with further detail as it becomes available. We cooperate with you on your own notifications to regulators and data subjects.

If a government authority asks for your data, we tell you unless the law forbids it, challenge requests that look unlawful, and disclose only the minimum a binding order requires.

Changes to our providers

We give at least 30 days' notice before a new subprocessor starts processing personal data or an existing one materially changes what it does. You can object within 15 days on data protection grounds. If we cannot resolve the objection, you can terminate the affected service without penalty.

Your data when you leave

You can export your records in CSV and PDF at any time, and your certificate register in the IAF CertSearch upload format. After the contract ends we keep your data for three months so you can take a final export. Then we delete your database and every backup, and confirm deletion in writing on request.

Audits and records

Once a year, on request, we provide the information needed to show we meet the Data Processing Addendum, and you or an independent auditor can audit our processing with 30 days' notice. We keep records of processing carried out for you, including under Article 30(2) GDPR where it applies.

Availability and support

Our availability target is 99.5% a month, and we aim to give at least 48 hours' notice of scheduled maintenance. Support runs during India business hours, which overlap the European morning. Detailed terms are in your Master Software-as-a-Service Agreement.

What Certyze does not do

Certyze is software. It does not perform conformity assessment, issue certificates or make accreditation decisions. Your certification body keeps every one of those decisions, from audit duration and competence to the certification decision itself. Automated outputs such as man-day calculations and eligibility checks follow the rules you configure, and are there to support your professional judgement, not replace it.

Reporting a vulnerability

Security researchers can report vulnerabilities in certyze.com and app.certyze.com under our Vulnerability Disclosure Policy. Write to legal@thinkdatalabs.com.