Security
Our actual posture, stated plainly. SaaS-appropriate, no theater.
- Certificate data is used only for your tracking and reminders — never sold, never shared.
- SMTP credentials (if you configure email alerts) are environment-configured, never in code.
- The reminder engine is idempotent; alert delivery is logged per certificate and window.
- Scanned PDFs with no text layer are flagged for human review rather than silently accepted.
- Report a vulnerability: email us and we'll respond within 2 business days.
What we don't claim: we don't claim certifications we don't hold,
we don't claim "military-grade" anything, and we don't claim a system can't fail — we claim the
specific controls above and a 2-business-day response on reports.