Security Policy

1. Overview

Protecting Customer Data is central to CertiTrack. Controls align with the sensitivity of compliance and identity data handled for Canadian regulated industries.

2. Core controls

• TLS for data in transit; encryption at rest on primary infrastructure
• Role-based access within tenants; optional organization MFA policy
• Per-user authenticator MFA enrollment
• Audit logging for security-relevant actions where enabled
• Canadian primary hosting (see Privacy Policy and Subprocessors)
• Secure development practices and dependency monitoring

3. Customer responsibilities

• Strong passwords and MFA for privileged users
• Correct role assignment and timely offboarding
• Protecting API keys, SSO certificates, and SFTP credentials

4. Vulnerability disclosure

Report suspected vulnerabilities to security@espyads.net. Please include steps to reproduce and avoid accessing other tenants’ data. We will acknowledge reports and work in good faith toward remediation.

5. Related pages

Privacy · DPA · Subprocessors