Security & data handling
These controls are implemented today. CertifyPreflight can prepare and import reviewed Product Registry records and can request certification only after CPSC confirms the connected user’s Certifier role and that user gives a separate authorization. The broker’s ACE transmission remains a separate action. This is a product disclosure—not a claim of SOC 2, ISO, government certification, or legal compliance.
A user must be signed in and hold approved customer workspace access before a document can be stored. Uploaded files are placed in a user-specific storage path, and document records are retrieved by the authenticated owner ID.
The beta accepts a defined set of document formats, rejects files larger than 10 MB, and checks each file signature so its contents match the declared format before storage. File names are normalized before storage.
Customer-provided Product Registry API credentials are verified server-side, encrypted at rest with an environment-held key, excluded from saved workspace state, and never returned to the browser. Product Registry imports require two-step verification, explicit per-import authorization, server-side validation, a fresh collection-role check, and an idempotency record that blocks accidental duplicate retries. Certification also requires CPSC’s exact Certifier role and a separate authorization. Development credentials remain hosted server secrets.
Account and collection checks are restricted to authorized users. Certificate-data imports require two-step verification, a selected collection, server-side validation, and explicit authorization for that individual import.
CertifyPreflight re-fetches the selected Product Collection immediately before dispatch. Import is limited to a writable collection role. Import-and-certify is blocked unless CPSC also returns the exact Certifier role and the signed-in user gives a separate certification authorization. Without that role, the record is imported only for later certification.
The importer and its authorized account users remain responsible for reviewing the final information, authorizing each import, and completing any required certification or broker handoff.
An importer can share a fixed case snapshot with one specified broker email for 14 days. The evidence snapshot cannot be edited; notes, change requests, and review completion are stored in a separate feedback layer. The broker must sign in with that exact address and use two-step verification. Access can be revoked and excludes original uploads, CPSC credentials, payment data, and other workspaces.
Customer access is granted, suspended, and expired from a protected operator console. A valid sign-in alone does not unlock real-document analysis.
Sensitive operator consoles and CPSC connection checks require both an approved operator account and two-step verification through the identity provider.
Public fit checks use a hidden bot field and privacy-preserving request-rate key. Authenticated uploads, workspace saves, applications, support requests, payment-session creation, and selected operator actions are protected by server-enforced request limits.
Customers can permanently delete individual documents from their authenticated workspace. The server verifies ownership before deleting both the private file and its record.
Completion-survey responses are stored with the signed-in customer account for product improvement. A customer may allow follow-up about a possible quote, but nothing is published automatically.
A completeness screen may move an eligible Guided Pilot application to payment readiness, but it never makes a compliance determination. Workspace access is activated only after an approved scope and a verified payment event when billing is enabled.
Payment-card entry occurs on Stripe-hosted Checkout. CertifyPreflight stores payment status and identifiers needed for reconciliation, not full card numbers. Signed webhook verification activates or updates customer access after Stripe confirms the payment or subscription event.
Beta limitations
Questions or deletion requests
Individual files can be deleted directly inside the workspace. Account-wide deletion and other data questions are handled through the private Support form. Do not email sensitive product files.
eric@certifypreflight.com