Guide

Security and privacy

CertKing is architected so that certificate data is never exposed by accident, and verification is always trustworthy.

How verification works

• Every certificate stores a SHA-256 hash of its exact rendered PDF.
• The public verification page is served server-side from CertKing's backend — the certificate database is never readable directly from the browser.
• Uploading a PDF compares its hash against the stored record, so any tampering is detected instantly.

Privacy controls

• Organizations can hide sensitive fields (email, score) from public pages.
• Recipients can hide their certificate from public listing where the org allows.
• Data handling follows India's DPDP Act and GDPR guidelines, including export and deletion.

Tenant isolation

All access is checked server-side against your organization membership and role. Clients never read from the database directly; they only call authenticated server functions.