What we store, and for how long
CertifiKitholds insurance certificates belonging to your vendors and subcontractors. That is other people’s business information, held on your behalf, so here is exactly what happens to it — in plain English, near the top, rather than in a clause on page four.
The free checker stores nothing
If you upload a certificate on the free checker without an account, the file is read in memory, checked, and discarded when the request finishes. It is never written to disk and never leaves the server that processed it. We keep an anonymous record that a check happened — the verdict and a confidence band, with no document and nothing identifying you.
Inside an account, we keep three things
- The certificate itself, because “show me the original” is what makes a verdict defensible when somebody disputes it later.
- What we read from it and what we decided, stored exactly as it was at the time, so a verdict stays explainable even after we improve how we read certificates.
- Vendor and agent contact details, because emailing the issuing agent the exact list of fixes is the product.
We do not sell any of it, we do not use your vendors’ certificates to train models, and we do not share a vendor’s documents with anyone outside your organization.
We keep records for 7 years
While a vendor is active, and for 7years after you stop tracking them. That window is deliberately long, because the reason to keep a certificate is the reason you collected it: a liability claim can surface years after the work, and the record of what a vendor’s coverage was on the day they were on your site is the evidence you will want.
The clock starts when you archive a vendor — never when a certificate expires. A lapsed certificate is the single most important thing to still have a record of.
Deleting your account deletes everything
Close your organization and we purge it after 30 days — a grace period that exists so an accidental deletion is recoverable, not so we can keep your data. The purge covers:
- certificate documents in Blob storage
- certificate extractions, verdicts, and audit events
- vendor and agent contact details
- requirement templates and projects
- notification history
Export your audit packet first — it is a complete copy of every certificate and verdict, and it is yours. Leaving should not mean losing your records.
One thing we will not do
We will not delete individual certificates or verdicts from inside a live account on request. That history is an audit trail, and an audit trail you can edit is not worth having — it is the thing that lets you show what you knew and when you knew it. If you need it gone, that is an account deletion, which removes all of it together.
Who else touches this data
The certificate is read by OpenAI’s API to extract the fields. Documents are stored with Vercel, records with Neon, sign-in is handled by Clerk, and email and text messages go out through Resend and Twilio. Each is a processor acting on our instructions, and none of them receive your data for their own purposes.
How we measure the site
Four tools measure how the site and the product get used. None of them receive a certificate, and none of them are sold anything about you.
- PostHog — counts visits and which buttons get used, and holds the anonymous record that a free check happened. Runs on public pages and inside the product.
- Ahrefs — shows which pages people arrive on from a search engine. Runs on public pages only.
- Microsoft Clarity — replays how a visitor moved through a page, so we can see where the site confuses people. Runs on public pages only.
- Google Analytics — counts visits again, in the tool most search and advertising work expects. Runs on public pages only.
The distinction in that last line is the one worth reading. Ahrefs, Clarity, and Google Analytics stop at the pages anyone can read without signing in. PostHog also runs inside the product, where it records which screens were opened and which buttons were used — never the contents of a certificate, and never a document.
Clarity replays what a visitor did on a public page, so the free checker’s report is deliberately hidden from its recordings: a replay shows that someone checked a certificate without showing what was on it.
Between them these see ordinary web traffic — which page, roughly where you came from, what got clicked — and each sets its own cookies or browser storage to recognise a returning visitor. Your browser’s tracking-protection settings apply here as they do on any other site.
Questions, or a deletion request
Email hello@certifikit.ai. A person reads it.
CertifiKit provides decision support for reviewing certificates of insurance. It does not provide insurance, legal, or coverage advice — always confirm requirements with your insurance professional.