This policy explains what we collect when you use the Certinite dashboard, API, and agents; why we process it; how long we keep it; who we share it with; and the choices available to you.
Last updated: October 1, 2026
Minimal edge footprint
Agents report structured job outcomes and health signals so the control plane stays accurate—without turning every host into a verbose log warehouse.
Orchestration, not surveillance
We collect metadata needed to issue, renew, validate, and bind certificates. We do not harvest application source code, arbitrary file contents, or unrelated server logs as part of the product.
Tenant boundaries
Workspace and role design aims to keep customer environments logically separated, with access enforced at the application layer.
Certinite provides certificate lifecycle management (CLM) for teams operating Windows IIS, Linux web stacks, and related infrastructure. Operating that service requires processing account information, configuration you provide (such as domain names and validation settings), operational telemetry from agents, and billing records where applicable.
This policy is meant to be read alongside our Security page, which describes trust boundaries, connectivity patterns, and security practices at a higher level. If anything here conflicts with an enterprise agreement you signed with us, the agreement controls for that customer relationship.
This policy applies to visitors of our marketing site, registered users of the Certinite dashboard and API, and organizations that deploy Certinite agents to managed infrastructure.
If you use Certinite on behalf of a company, you represent that you have authority to bind that organization to these terms and that any personal data you submit is handled in line with your employer’s policies and applicable law.
Depending on how you use Certinite, we may process:
Identifiers such as name, email address, authentication provider subject (for social login), and organization or workspace identifiers you create.
Domain names, DNS or HTTP validation configuration, certificate metadata (for example identifiers, issuance status, expiry dates, and binding targets), job history, audit-friendly event records, and support tickets you submit.
Structured signals required to operate renewals safely—such as agent identity, connectivity status, OS and runtime context needed for compatibility, and outcomes of local execution steps—sent over authenticated channels.
Billing contact details and transaction records processed by our payment provider. We generally do not store full payment card numbers on Certinite infrastructure.
IP addresses, device/browser signals, and security logs used to protect accounts, detect abuse, and maintain service reliability.
Certinite agents are designed to poll or connect outbound to the control plane for work and to interact with local certificate stores and web server bindings as required by your configuration. Normal operation should not require opening inbound management ports to Certinite for agent command-and-control.
We do not use the agent to read your application source code, database contents, or arbitrary directories unrelated to certificate installation and validation. You remain responsible for securing local credentials and for configuring least-privilege on managed hosts.
We process data for purposes that typically include:
We retain information for as long as your account is active and as needed to provide the service, comply with law, resolve disputes, and enforce agreements. Retention periods can vary by data category and legal requirements.
When you delete a workspace or request deletion where applicable, we will delete or anonymize personal data consistent with backups, legal holds, and technical constraints. Some records may persist in encrypted backups for a limited period before aging out.
We implement administrative, technical, and organizational measures designed to protect data against unauthorized access, loss, or alteration. Measures may include encryption in transit, access controls, monitoring, vulnerability management, and least-privilege internal access.
No method of transmission or storage is perfectly secure. If we become aware of an incident that affects your data in a material way, we will notify you where required by law and in line with our incident response procedures.
Depending on where you live, you may have rights to access, correct, delete, or export certain personal data; to object to or restrict certain processing; or to withdraw consent where processing is consent-based.
To exercise rights, contact us using the details in the Contact section. We may need to verify your request. If you are in the EEA/UK, you may also lodge a complaint with your local supervisory authority.
We may update this policy to reflect product changes, legal requirements, or clarifications. We will post the updated version with a revised “Last updated” date. Where changes are material, we will provide additional notice as appropriate (for example email or in-product notice).
For privacy questions or requests, contact us through the support channel listed on the Certinite website or in your workspace. Please include your workspace identifier and a concise description of your request to help us respond quickly.
The product is designed to minimize unnecessary exposure of private key material. Operational details depend on your workflow and local configuration; our Security page describes the trust model at a high level. Treat private keys as highly sensitive regardless of tooling.
Many deployments use an agent to perform local installation and binding steps reliably. If your architecture uses a different integration pattern, availability depends on product capabilities at the time—check Documentation or contact support for your case.
We do not use your tenant certificate metadata or domain configuration to train generalized public AI models. If we ever offer optional features involving model training, we will describe them clearly and separately.
Use in-product account or workspace deletion where available, or contact support. Some records may be retained where law requires or for legitimate security and fraud-prevention reasons.
Read Security and Docs, then start a workspace when you are ready to evaluate in a non-production environment.
This policy is informational and not legal advice. Consult counsel for your regulatory context.
