Is my data secure?
CertNudge is registered with the Information Commissioner’s Office (ICO), as stated in our Privacy Policy. We operate processes intended to meet our obligations under UK data-protection law.
Security controls reduce risk, but no online service can promise absolute security or guarantee that a breach or data loss could never occur.
How certificate files are stored
Uploaded files are held in private Microsoft Azure Blob Storage rather than being made publicly available.
Normal authenticated downloads use short-lived authorised access. Files shared through CertNudge can also be accessed by anyone holding a valid, active share link until that link expires or is revoked.
Security and access controls
Private file storage
Certificate evidence is stored in private Azure Blob Storage and is not intended to be accessible through an unrestricted public file address.
Authorised account access
Organisation users can access records according to the permissions and roles available to their account.
Time-limited sharing
Secure share links are time-limited and can be revoked. They are bearer links, so anyone who obtains an active link may be able to access the shared resource.
Operational access
CertNudge restricts operational access to authorised, need-to-know purposes required to operate, maintain or support the service.
Data protection
CertNudge is registered with the Information Commissioner’s Office as stated in the Privacy Policy and operates processes intended to meet its UK data-protection obligations.
The Privacy Policy explains:
- what personal information is collected and why;
- which service providers are used to operate CertNudge;
- how information is retained and deleted;
- the data-protection rights available to users.
What should I upload?
Suitable records
- Property safety certificates
- Inspection and testing reports
- Remedial-work evidence
- Relevant property compliance photographs
Do not upload
- Passports, driving licences or identification
- Tenancy agreements or tenant references
- Bank statements or payment information
- Unnecessary tenant names, contact details or other personal data
Protecting your account
- Use a unique password: Do not reuse the password from another website or service.
- Enable two-factor authentication: Use the available authenticator-app security option and keep your recovery codes safe.
- Review team access: Remove access for anyone who no longer needs to use the organisation’s records.
- Protect share links: Send links only to the intended recipient and revoke them when they are no longer needed.
No system is risk-free
Keep your own appropriate records and download copies of important evidence when needed. Contact CertNudge promptly if you believe an account, document or share link may have been accessed without authorisation.