Last Updated: July 2026
CertVault collects your name, email address, password hashes, certificate metadata (issuers, dates, credential identifiers, verification links), and uploaded document files solely to deliver credential vault, renewal monitoring, and developer API services.
When you enable the Public Portfolio Feed on your settings dashboard, any certifications marked as public are queryable by anonymous network clients. Your private API access tokens and database credentials are cryptographic SHA-256 hashes and are never exposed publicly.
Uploaded certificates are stored as Base64 data within encrypted database records. Uploaded files are restricted to standard image formats and PDF documents under 4.5MB.
We deploy HTTP-only cookies to persist user sessions via NextAuth. Edge proxy nodes enforce IP-based rate limiting (maximum 100 requests per minute) to defend endpoints against abuse.