Security and Governance for Institutional Credentials
Protect institutional credential workflows with controlled access and secure operations.
-
No credit card required
-
-
Cancel it anytime
-
-
7-day free trial
.png)
Institutional trust requires evidence and clear responsibilities
CertifyMe serves 5K+ institutions and 1M+ learner wallets worldwide. Enterprise SSO and MFA are standard. Hosting is available across the globe; specific residency, transfer, retention and deletion requirements are agreed contractually. Certification and attestation scopes are distinct from guarantees about every credential, receiving system or future service.
5000+
Institutions trust
CertifyMe
1M+
Learner wallets
worldwide
Global reach
Across diverse regions and sectors
Information Security Management — ISO/IEC 27001:2022
CertifyMe's ISO/IEC 27001:2022 certificate covers the information security management system for SaaS digital-credential activities. Its status is active following 2026 surveillance, with a printed expiry of 4 June 2027. Request the current certificate and assess access controls, risk management and incident response alongside your institution's responsibilities.
Privacy, Quality and Business Continuity
ISO/IEC 27701:2019 covers privacy information management; ISO 9001:2015 covers quality management; ISO 22301:2019 covers business continuity. ISO 14001:2015 concerns environmental management, not cybersecurity. Ask for the relevant certificate scope and current maintenance evidence during procurement.
GDPR Policy, DPA and Contractual Data Residency
CertifyMe's enterprise GDPR policy, effective 1 July 2026, describes controller/processor responsibilities, transfer safeguards, retention, incident response and subprocessors. It is a policy, not a GDPR certification. Agree residency and transfer requirements during contracting; request the current subprocessor list and DPA. Minimise learner attributes rather than assuming credentials contain no personal data.
Impressive range of features sets it apart as the ultimate solution for certificate verification. Their enterprise plan, along with customizable options, caters to diverse company needs, making it an awesome choice.
What truly stands out about CertifyMe is the remarkable support provided by their customer success team. They go above and beyond to ensure a seamless experience. Additionally, the platform boasts a clear and intuitive user interface, allowing easy navigation and customization.
As a training provider, we appreciate the user-friendly interface and customizable digital badging options, which our students enthusiastically showcase on their social media profiles.
It offers an end-to-end solution, is user-friendly with single-click awarding, enables students to share badges on LinkedIn, provides branding options, and has excellent customer support and training.
Evidence for institutional procurement
SOC 2 Type II Attested: examination period 1 February–30 April 2026; criteria Security, Availability and Confidentiality. The restricted-use report is available through an appropriate procurement process, not as a public website download. Review its scope, complementary customer controls and subservice responsibilities before relying on it for your implementation.
| Management-system standard | Scope | Printed expiry |
|---|---|---|
| ISO/IEC 27001:2022 | Information security management | 4 June 2027 |
| ISO/IEC 27701:2019 | Privacy information management | 5 September 2027 |
| ISO 9001:2015 | Quality management | 28 April 2027 |
| ISO 14001:2015 | Environmental management | 16 September 2028 |
| ISO 22301:2019 | Business continuity management | 8 February 2029 |
Request current certificates and surveillance information during procurement. Printed expiry dates alone do not establish continuing certification status.
Shared responsibilities before rollout
Agree identity and access policies, evidence requirements, retention, correction, revocation, backup and continuity arrangements. Validate the actual API permissions, integration workflows and credential-verification process for your institution.
Standards scope: 1EdTech's registry lists Open Badges 3.0 Issuer and CLR 2.0 Issuer/Displayer roles. These certifications do not establish universal wallet acceptance or certify every individual record.
Security for institutional credential workflows
Institutional credential programmes depend on protected learner data, controlled access and reliable operations. CertifyMe's security information describes the assurance scope and responsibilities supporting these workflows. SSO and MFA are standard for enterprise customers, while access controls and data-processing terms align the platform with institutional requirements. SOC 2 reporting and ISO management-system certifications address their defined assurance purposes; credential-standard certifications address specified interoperability roles. Deployment and data-residency arrangements are established through the customer agreement, including relevant processing and support responsibilities. Credential verification adds record-integrity checks alongside these platform controls. Together, these foundations support universities, certification bodies and other institutions as they manage awards and learner records.
Common questions
Answers to the questions institutional teams ask.
What does CertifyMe's SOC 2 Type II report cover?
CertifyMe’s restricted-use report covers Security, Availability and Confidentiality for the examination period 1 February–30 April 2026. SOC 2 is an attestation, not a certification. Obtain the report through the procurement process and assess complementary customer and subservice controls.
Are SSO and MFA included for enterprise customers?
Yes. SSO and MFA are standard at the enterprise level. Confirm authentication protocols, enforcement policies, account roles and implementation details for your institution.
Where is institutional data hosted?
Hosting is available across the globe. Specific residency, processing, support access, backups and cross-border transfers are contractual matters; global hosting does not mean every account automatically has a particular residency guarantee.
Is the GDPR policy a certification?
No. The enterprise GDPR policy describes privacy processes and contractual responsibilities. Request the applicable DPA, transfer safeguards and subprocessor list; it does not establish independent GDPR certification.
Does cryptographic verification eliminate issuer dependencies?
No. Verification can depend on available issuer keys, status resources and supported formats. Institutions should plan key management, revocation, correction, access and continuity rather than assuming that a signature removes all dependencies.
What is credential-platform security?
Credential-platform security protects data and operations through authorized access, controls, monitoring and evidence of assurance within a defined scope.
Why does credential-platform security matter?
Credentials and learner records contain information whose privacy, integrity, availability and accountable handling matter to institutions and learners.
How does credential-platform security work?
Controls govern access, protect data in transit and at rest, monitor activity, and support incident and continuity processes. Procurement assesses the relevant independent reports and customer responsibilities.
How does CertifyMe implement credential-platform security?
Enterprise SSO and MFA, access controls and agreed deployment terms support institutional credential programmes. CertifyMe's security documentation describes the applicable SOC examination and ISO management-system scope, with customer responsibilities defined alongside those controls.
What standards apply?
SOC 2 reporting, ISO management-system certification and applicable privacy law concern different assurance questions. Open Badges/CLR conformance and the W3C VC model do not substitute for them.
How is this different from the related concept?
Security controls protect the platform and its data; credential proof supports record-integrity checks. Residency is a contractual processing question, not a synonym for global hosting.
When should an institution use this?
Security and privacy controls support learner-data processing, institutional integrations and ongoing credential verification.
What are the limitations?
This website is not the complete audit report or contract. Current assurance periods, scope, subprocessors, transfers, customer controls and selected regions require procurement review; confidential evidence is not a public download.
Sources & References
The references below explain the relevant standards. CertifyMe's product information and customer case studies describe institutional capabilities and adoption.
Security assurance evidence: Request the applicable SOC 2 report, ISO certificates and processing terms during procurement. The CertifyMe security summary is a first-party description, not the complete independent report. The 1EdTech credential registry does not establish SOC 2, ISO or privacy-law compliance.
Definitions and relationships · learner-record provenance · reviewed skills mappings · evidence-led platform comparisons
References accessed 4 October 2026.
From credential issuance to institutional records
CertifyMe's credential lifecycle connects institutional award approval with issuance and ongoing record maintenance. Open Badges 3.0 structures achievement information, while the W3C Verifiable Credentials model defines issuer, holder and verifier relationships. Supported formats enable exchange with compatible receiving systems.
Verification checks proof, issuer authority and applicable status resources. Institution-reviewed skills relationships connect assessed outcomes to capabilities; a Comprehensive Learner Record retains achievement provenance. Workforce intelligence then relates those skills to occupations and separately sourced market information—not a guarantee of employment.
Institutional authority, connected capabilities
Registrars retain authority over official records, and academic teams govern assessed learning. Career services gain a richer presentation of learner achievement and opportunity context. APIs and supported integrations connect institutional workflows, with security and deployment terms aligned to the programme.
Universities, certification bodies, employers, government agencies and training providers can use CertifyMe to manage their credential programmes. Explore digital credentials for universities, platform comparisons and customer case studies.
See CertifyMe for Your InstitutionCertifyMe's Open Badges and CLR product-role certifications are listed in the 1EdTech registry.