This English version is a courtesy translation. If it differs from the Spanish version, the Spanish version governs.

Our approach

Certia designs and operates technology for institutions that handle sensitive information, and it applies the practices described here to its own website and internal tools. This page describes working practices and does not claim any certification. No control removes all risk, so we also explain how we respond to incidents and how you can report a vulnerability to us.

Encryption

Every connection to certiaholding.com uses HTTPS with TLS. Data is stored encrypted at rest on the infrastructure of our hosting and database providers.

Least-privilege access

Each team member can access only what their role requires. The internal panel requires authentication and keeps the session in httpOnly cookies, which page code cannot read. We remove access when someone changes role or stops working with us.

Database security

The database enforces row level security: each query is checked against the role of whoever makes it, and the public cannot read contacts, subscribers or requests. Keys with elevated privileges are used only on the server and never reach the browser.

Audit trail

Relevant administrative actions, such as configuration changes or the handling of rights requests, are logged with a date and the person responsible. This lets us reconstruct what happened and who did it.

Separate environments

Development, testing and production run separately and with different credentials. We do not copy real production data into test environments.

Secure development

We review code before publishing it, validate form inputs and keep secrets out of the repository. We also check dependencies for known vulnerabilities. The site sends security headers and a content security policy.

Offensive testing of our own systems

We put our own surfaces, such as the website, the forms and the programming interfaces, through dynamic scans and offensive security tests, using the same approach we follow in our offensive cybersecurity services for clients. We fix findings according to their severity.

Incident response

We have a procedure to detect, contain and analyze incidents, and to fix their cause. If an incident affects personal data, we follow the notification steps described on the Personal data protection page.

Vendor review

Before adding a vendor, we review how it protects information, where it processes it and what contractual commitments it accepts. We prefer vendors that let us turn off data retention and training, as we do with the AI models behind the site's assistant.

Confidentiality

Team members and vendors with access to client information sign confidentiality agreements.

Human review of AI

Output from an AI model can contain errors. In the services we operate, a person reviews outputs that influence decisions about customers or sensitive communications before they take effect.

How to report a vulnerability

If you find a possible vulnerability on certiaholding.com or in another Certia service, write to certia@fidelity-ec.com with the subject "Seguridad". Include a description of the issue, the steps to reproduce it, the address or component affected and the impact you observed.

While we look into it, we ask you to:

Not access, modify or delete other people's data. If you come across it, stop and tell us.
Not degrade the service or run denial of service tests.
Not use social engineering against our team or our clients.
Not disclose the finding until we have fixed it or agreed on a date with you.

We confirm that we received your report and let you know when the issue is fixed. Active testing of our systems requires prior written authorization, as stated in our Terms of use.