Data and payment security
Payments processed by Stripe
All card payments are handled exclusively by Stripe, one of the largest payment processors in the world. Stripe is certified PCI DSS Level 1, the highest security standard in the payments industry. Your card details are entered directly into Stripe's secure form and never reach Certcar's servers: we do not store or see your card number, CVV code or expiry date.
Encryption in transit
All communication between your browser and certcar.com is encrypted with TLS (HTTPS). Traffic also passes through Cloudflare infrastructure, which protects against DDoS attacks and filters malicious traffic before it reaches our servers.
Account protection
Passwords are stored only as cryptographic hashes (bcrypt). Not even the Certcar team can read them. Signing in with Google or Facebook uses the OAuth protocol, so the password of your external account never passes through our systems. Accounts with administrative access are additionally protected by two-step verification (email code).
Data retention and minimisation
We collect only the data needed to provide the service, in line with the GDPR. Vehicle history reports remain available in your account for 30 days after generation. You can request access to your data or delete your account at any time, as described in our Privacy Policy.
Have a security question?
If you have found a vulnerability or have questions about how we protect data, write to us at [email protected]. Security reports are treated with priority.