Trust & Security

CertScore.ai production services run in hosted Amazon Web Services infrastructure. Production is deployed through repository-controlled AWS workflows; local development tooling is not used as the production runtime.

Public web and MCP endpoints use HTTPS/TLS. Administrative product routes require authenticated platform-administrator authorization. Service roles and infrastructure policies scope workload access to the resources needed for each service, and sensitive runtime values are injected from managed secret stores rather than committed to application source.

Application credentials and signing material are supplied to production workloads through dedicated secret-management systems rather than stored in source code.

Hosted MCP connections support the OAuth 2.0 authorization code flow with PKCE. Approved scopes limit read and scan-creation access, and protected requests validate the resulting access token before processing.

CertScore.ai primarily analyzes publicly accessible website behavior. Retained scan evidence can include cookie and storage observations, tracker or vendor detections, consent controls, privacy-policy content or bounded excerpts, HTTPS/TLS observations, screenshots, and scan metadata.

The service also processes the account, authentication, billing, support, and operational data needed to provide the product. Details are described in the Privacy Policy.

Public production endpoints use HTTPS/TLS with managed certificates. Checked-in AWS infrastructure configures encryption at rest and public-access blocking for managed object stores used by the service where those stores are defined in infrastructure code.

MCP authorization tokens are validated before protected requests are processed. MCP telemetry is designed to exclude authorization headers, bearer tokens, request bodies, raw IP addresses, and client secrets.