Privacy policy
Last updated: · Version 2.2
1. Who we are
CertSteady helps teams get their website and server TLS certificates under control. On certsteady.com we offer a free public Certificate Readiness Check and guides about certificate renewal. The site has no accounts and sells nothing.
The controller responsible for the personal data described in this policy is Smbat Tonoyan, Yerevan, Armenia, a private individual who operates CertSteady. In this policy, “CertSteady”, “we” and “us” refer to that operator.
For anything about your data, email [email protected]. We have not appointed a data protection officer; requests sent to this address are handled by the operator directly.
2. What this policy covers
This policy covers personal data we handle when you:
- visit certsteady.com or run a Certificate Readiness Check and view its report; and
- email us, for example with a question about your results or a security report.
We wrote this policy to meet the EU General Data Protection Regulation (GDPR) and the Law of the Republic of Armenia on Protection of Personal Data, and we respect the rights that other data protection laws give you where they apply. Legal bases are stated in GDPR terms because they are widely understood. Much of what the check handles is public technical data about servers, not about people, but we treat it with the same care where it could relate to you.
3. The free check
The domains you check and their reports
When you run a check we store the domain you entered and the report we build for it: host names found in public Certificate Transparency logs (up to 100 per check) and the public certificate details each host presented over HTTPS, such as issuer, validity dates and the names on the certificate. A report from the free check is not linked to you: we do not store your IP address, name or email with it. A domain or certificate can contain a person’s or organization’s name, so we treat this as personal data where that is the case.
Why: to run the check you asked for and show you the report. Legal basis: our legitimate interest in providing the free check that you request (GDPR Art. 6(1)(f)). Entering a domain is needed to run a check; without it we cannot provide one.
How a check works
Our server sends the domain you entered as a search query to crt.sh, a public Certificate Transparency search service. When crt.sh cannot answer or finds no certificates, the same query goes to Cert Spotter, another public Certificate Transparency search service. Our server then looks up each host name in public DNS and opens one TLS connection to port 443 to read the certificate the host presents to any visitor. These services and the hosts being checked see a request from our server, not from you, and receive no data about you. Host names found in Certificate Transparency logs are cached briefly, with no link to who asked, so that repeated checks of the same domain do not query the public services again. See Security for how the scanner behaves.
Abuse prevention
To stop the service being overloaded or used to scan other people’s servers in bulk, we limit how many checks each network can start in a given time. For this our server uses your IP address in memory only. It is never written to a database, a file or a log, and it is forgotten once the limit no longer needs it, and in any case when the application restarts.
Legal basis: our legitimate interest in keeping the service secure, available and fair to everyone (GDPR Art. 6(1)(f)).
4. Running the service
Server logs
Our application writes technical logs: events such as a check being accepted or finished, errors, timings and short internal references. The logs do not contain IP addresses, email addresses or full report links; they are filtered automatically to remove them if one ever slips in.
Encrypted backups
Once a day our server makes a copy of its database, encrypts it on the server and uploads only the encrypted file to a private channel in the operator’s workspace at our messaging provider (see section 7). The decryption key is kept by the operator and is never stored on the server or with the provider. A backup contains the same data as the live service, mainly the domains checked and their reports.
Operational alerts
The service sends the operator short alerts, for example when it starts, when a backup finishes or when checks fail more often than usual. They contain counts and error codes only, no personal data.
Legal basis for logs, backups and alerts: our legitimate interest in running, securing, recovering and fixing the service (GDPR Art. 6(1)(f)).
Network delivery and protection
Every visit to our site passes through our network provider (see section 7), which necessarily sees your IP address, browser user agent and the pages you request in order to deliver the site, protect it from attacks and block abusive traffic.
Legal basis: our legitimate interest in delivering a fast and secure site (GDPR Art. 6(1)(f)).
5. Emails you send us
If you write to one of our addresses, such as [email protected] or the security contact, we receive your email address, your name if you give it, the content of your message and anything you choose to include. Incoming email is received by our network provider and forwarded to our mailbox provider; our replies are sent through our email sending provider (see section 7).
Why: to answer your question, handle your request, for example to delete a report early, and handle security reports.
Legal basis: our legitimate interest in answering the people who contact us and running the service (GDPR Art. 6(1)(f)); where you use a data protection right, our legal obligation to handle your request (GDPR Art. 6(1)(c)).
Please do not send us personal data you do not need to, such as other people’s data in screenshots or logs.
6. Legal obligations and claims
Where the law requires us to keep or disclose information, for example to answer a valid request from a court or authority, we do so on the basis of that legal obligation (GDPR Art. 6(1)(c)), and only to the extent required. We may also use data where needed to establish, exercise or defend legal claims (GDPR Art. 6(1)(f)).
7. Who receives data
We do not sell, rent or trade personal data, and we do not share it for advertising. We use a small number of service providers to run CertSteady. They process data under their terms of service and data processing terms, which oblige them to keep it secure and to use it only to provide their services.
| Recipient | What they do and what they receive |
|---|---|
| Contabo GmbH, Germany | Hosts our server. Reports, the database and our logs are stored on that server. |
| Cloudflare, Inc., USA | Network delivery, DNS, attack protection and the secure connection to our server, and receiving email sent to our addresses. It processes visitors’ IP addresses and request data, and the content of emails sent to us. |
| Google LLC, USA | Hosts the mailbox that emails sent to our addresses are forwarded to. It receives the content of emails you send us. |
| Zoho Corporation, USA | Sends our email replies. It processes the recipient’s address and the content of the emails we send. |
| Slack Technologies, LLC, USA | Stores our daily database backups, and receives operational alerts that contain no personal data. The backups are encrypted on our server before upload, and Slack cannot decrypt them. |
| crt.sh (public Certificate Transparency search) | Receives the domain you entered as a search query, from our server. It receives no data about you. |
| Cert Spotter (public Certificate Transparency search) | Only when crt.sh cannot answer or finds no certificates: receives the domain you entered as a search query, from our server. It receives no data about you. |
We may also disclose data where the law requires it, to protect the rights, safety or property of our users, the public or us, or as part of a transfer of CertSteady to a new operator, who would remain bound by this policy for data collected under it. Anyone who has the link to a report can view it; see our Terms on sharing report links.
8. International transfers
Our server is hosted by Contabo GmbH, a provider established in Germany, in the European Union. CertSteady is operated from Armenia, so the operator accesses and administers data from Armenia. Cloudflare, Google, Zoho and Slack are based in the United States and may process data there and in other countries where they operate.
Where personal data protected by the GDPR or Armenian law is transferred to a country that the European Commission or the Armenian authority has not recognized as providing adequate protection, the transfer relies on the protections the provider offers for such transfers, such as standard contractual clauses in its data processing terms or a recognized certification framework, where available. Backups are encrypted on our server before they leave it. You can ask us for more information about these protections at [email protected].
9. How long we keep data
We keep personal data only for as long as we need it for the purpose we collected it for, and longer only where the law requires it or where we need it to establish, exercise or defend legal claims. In practice:
| Data | How long |
|---|---|
| Domains you check and their reports | Temporary. Deleted automatically once they are no longer needed to show you and the people you share the link with the result of a check; the deletion runs on a fixed schedule set in our software. |
| IP addresses used for abuse prevention | Never stored. Held in memory only while a rate limit needs them, and lost when the application restarts. |
| Cached host name lists from Certificate Transparency | A short time, so that repeated checks do not query the public services again; then deleted automatically. |
| Application logs | Overwritten automatically, oldest first, once they reach a fixed size; not archived, and discarded when the service is redeployed. |
| Encrypted database backups | Kept for a limited rolling period so that we can recover the service after a failure, then deleted automatically. They contain the same data as the live service. |
| Emails you send us | As long as needed to answer you and handle any follow-up. Where they relate to a security report, a data protection request or a dispute, for as long as claims about it can be brought, or longer where the law requires it. |
Because backups are copies of the database, data deleted from the live service can remain inside encrypted backups until those backups are deleted. We restore from a backup only to recover the service; expired data is then removed again automatically, and we re-apply any deletion requests made since the backup was taken.
10. Cookies and tracking
Our site sets no cookies. We do not use analytics, advertising, social media plugins, tracking pixels, fingerprinting or any third-party scripts, and our site saves nothing in your browser’s storage.
Our network provider may set a strictly necessary security cookie if access protection is enabled for the site (for example for a preview) or to tell real visitors apart from abusive traffic. Such cookies are used only to protect the site, not to track you, and do not require consent.
11. How we protect data
We use technical and organizational measures suited to a small service, including:
- encrypted connections (HTTPS with HSTS) for every page and request;
- an application that accepts no direct connections from the internet: all visitor traffic reaches it through an outbound-only encrypted tunnel;
- IP addresses used in memory only and never written to disk;
- logs that exclude IP and email addresses;
- report links built from long random identifiers, and reports deleted automatically;
- daily backups encrypted on our server before upload, with the decryption key kept by the operator and never stored on the server or with the storage provider;
- strict security headers, a hardened container setup, and access to the server limited to the operator using key-based login.
No system is perfectly secure. If we become aware of a breach that affects your personal data, we will notify you and the relevant authority where the law requires it. To report a vulnerability, see Security.
12. Your rights
Under the GDPR, where it applies to you, and under the Armenian Law on Protection of Personal Data, you have the right to:
- access the personal data we hold about you and get a copy of it;
- rectification of data that is inaccurate or incomplete;
- erasure of your data, for example deleting a report early;
- restriction of processing, for example while a question about your data is being resolved;
- data portability, where it applies: receive data you gave us in a structured, machine-readable format, or have it sent to someone else;
- object at any time to processing based on our legitimate interests, on grounds relating to your situation. We then stop unless we have compelling legitimate grounds or need the data for legal claims;
- complain to a data protection supervisory authority, in particular in the EU or EEA country where you live, work or where you think the problem happened. In Armenia, the authority is the Personal Data Protection Agency. We would appreciate the chance to resolve your concern first.
We do not use consent as a legal basis for any processing described here. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects; the renewal estimates in a report are about certificates, not about people.
13. How to use your rights
Email [email protected] and tell us what you would like us to do. To delete a report early, include the report link: free reports are not linked to the person who started them, so the link is how we find it.
We reply within one month. If a request is complex we may need up to two more months and will tell you why. We may ask for information to confirm that a request really comes from you, for example a reply from the email address concerned. Using your rights is free unless a request is clearly unfounded or excessive.
14. Children
CertSteady is a tool for businesses and IT professionals and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has sent us personal data, email [email protected] and we will delete it.
15. Changes to this policy
We will update this policy when CertSteady or the law changes. The date and version at the top show the current version. If a change materially affects how we use data you already gave us, we will tell you in advance on the site and, where we have your email address, by email.
16. Contact
Questions or requests about privacy: [email protected]. Controller: Smbat Tonoyan, Yerevan, Armenia.