Where it runs

Momenial runs on Cloudflare: Workers for the application, D1 for the database, R2 and Cloudflare Images for files, Queues for background work and Turnstile for bot checks. The database is placed in Cloudflare’s Asia-Pacific region. Pages are served from Cloudflare’s global network, and a request may be handled in the data center closest to the data rather than the one closest to you.

Email is sent through Amazon SES in the United States (us-west-1). Issuers sign in with Firebase Authentication from Google. Holders sign in to their own page with a six-digit code sent to their email, valid for ten minutes and only in the browser that asked for it.

What we store

• About issuers: account and team details, the organization’s name, logo and brand settings, and billing identifiers from the App Store, Google Play or RevenueCat. We never see or store card numbers.
• About holders: what the issuer gives us (name, email or mobile number, the fields on the credential, a member or certificate number, and a photo to print on it if the issuer supplies one), and the holder’s own photo if they add one on their page.
• About each credential: its versions, files, status, history and delivery records.

Who can see what

A credential page and its files are public by design: anyone with the link or the QR code can open them. A holder can restrict their page when the issuer is on Professional or above. A restricted page asks visitors to request access, but its files stay reachable, so restricting is not the same as making a page private.

The employer search, on Enterprise plans, stores a hashed index only, never shows the email it was searched with, and drops a holder who opts out.

Retention and deletion

• Each version’s image, PDF and data are fixed at issue and never overwritten.
• Deleting a job, batch, project or account never deletes a credential. Only a withdrawal erases the files and the holder’s name.
• When an issuer deletes its account, its credentials stay available to their holders, with the issuer’s name and logo as they were. Holder contact details are blanked 90 days later.
• When a plan ends, pages on cert.fyi and on a custom subdomain stay up. Pages on the issuer’s own domain go offline until that domain is reconnected.

Subprocessors

The companies that process data for us, what for and where, are listed on the subprocessors page.

Access and operations

Production access is limited to the people who run the service. API keys are scoped and stored hashed. Public lookups are rate-limited and protected by Turnstile. Data is encrypted in transit, and Cloudflare encrypts it at rest.

Agreements

A Data Processing Agreement is available on request. Enterprise customers can have retention terms written into their agreement.

Contact

Report a security issue or ask a question at [email protected].