AutoCertify's whole job is trust, so we hold ourselves to the standard we sell. This page describes what's genuinely true about how we issue certificates, handle keys, authenticate access and treat your data — no aspirational claims, no borrowed logos.
Every certificate is a publicly-trusted, domain-validated (DV) TLS certificate issued through Cloudflare for SaaS and its Managed CA. There are no self-signed shortcuts and no private, untrusted roots — the same certificates a browser trusts everywhere else on the web.
A domain is only ever marked active once Cloudflare confirms both the custom hostname and its SSL certificate are genuinely active. We never optimistically flip a status green and hope issuance catches up — if it isn't truly live, we say so.
The custom-hostname payload we create is kept as small as it can be, and we practice least-data handling throughout: we hold the domain names and DNS records needed to issue and renew a certificate, and little else. Less data stored is less data at risk.
Certificates are managed on your behalf, so there are no private keys or PEM files to export, leak or lose — the key material stays inside the managed CA. All traffic to AutoCertify and its API is encrypted in transit over TLS.
Dashboard and portal access is authenticated with Auth0 — requests carry a Bearer JWT that we verify against Auth0's published JWKS. Programmatic access uses scoped API keys (ac_live_…) you can create and revoke, so automation never rides on your login session.
Every webhook we send is signed with a per-endpoint secret (whsec_…) using HMAC-SHA256, so your systems can verify a payload genuinely came from AutoCertify and wasn't tampered with or replayed before acting on it.
Domain, certificate and key account events are recorded to a tamper-evident, append-only audit log. Entries are added, never quietly edited or removed, so there's an accountable history of what happened and when.
Delegation health and certificate validity are checked on an ongoing basis. Renewals run well ahead of expiry, and if a DNS record drifts or a delegation breaks we surface it in the dashboard and over signed webhooks — so a lapse is caught early, never after the fact.
A green badge is only meaningful if you can trust it. AutoCertify treats issuance as a chain of real, verified checkpoints — and reflects exactly where a domain sits at each one.
We confirm the CNAME to _acme-challenge is live and pointing where it should, with a real DNS lookup — not an assumption.
Cloudflare reports the custom hostname itself is provisioned and active on the edge.
The certificate is issued and its SSL status is confirmed active — both conditions must hold before anything reads secured.
Validity and delegation health are checked on an ongoing basis so a lapse is caught early, never after the fact.
We're grateful to researchers who report issues privately and give us a chance to fix them. If you believe you've found a vulnerability in AutoCertify, please tell us before you tell anyone else.
Email a description of the issue, the steps to reproduce it, and anything we'd need to understand the impact. The more detail you can share, the faster we can confirm and fix it.
[email protected]On what we don't claim. We'd rather be precise than impressive. This page describes controls that are in place today; where we're still maturing a practice we'll frame it honestly rather than imply a certification we don't hold. Have a specific security or compliance question for your team's review? Ask us directly and we'll give you a straight answer.