Privacy Policy

Who we are

Certi.parts is published by Sico Software Ltd, a company registered in Scotland. Certi.parts lets manufacturers and their customers agree specifications, record production evidence and share signed job records. Design files stay with you: your browser computes a fingerprint and the file is never uploaded. We are registered with the UK Information Commissioner's Office (ICO). Privacy questions: privacy@sico.software.

Data we collect

Account data. Your email address, held through our authentication provider (SuperTokens), and your role in each workspace.

Company records. Your workspace name, facility names and addresses, and the customer and supplier connections you create.

Production records. Recipes, jobs, inspection readings, instrument references, approvals, and the names and fingerprints of evidence files. Evidence files you choose to upload are held privately for your workspace.

Network evidence. The network address observed when an operator signs off or dispatch is released, checked against your buyer-approved facility policy.

Signed records and receipts. Signed records name the people involved by account identifier. Signed bytes can't be edited after issue, so these identifiers are retained with the record.

What you share with a buyer. You choose which sections of a record a connected buyer receives. Once they accept or reject a record, they keep the sections you shared.

How we use your data

• To run your workspace and enforce its roles and approvals
• To sign records and let the right parties verify them
• To check release requirements such as facility policies
• To protect the service and investigate misuse

Data sharing

We do not sell your data. We share data only with sub-processors required to operate the service:

• Amazon Web Services — Key management in the UK: signs a fingerprint of each record. Record contents are not sent.
• Hetzner Online GmbH — our VPS provider (Germany, EU). All personal data is stored on this server.
• Resend Inc. — transactional email (account and billing notifications).
• PostHog Inc. — product analytics (page views, feature usage; no personal data).
• Sentry Inc. — error monitoring (stack traces; personal data scrubbed before transmission).

Data retention

We keep signed records, approvals and receipts for as long as your workspace needs them under its retention policy, including after a workspace closes, because they are quality records for both parties. Other account data is deleted when you close your account.

Your rights under UK GDPR

As a UK resident you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate data
• Erasure — ask us to delete your data ("right to be forgotten")
• Portability — receive your data in a machine-readable format
• Restriction — ask us to limit how we process your data
• Objection — object to processing based on legitimate interests

To exercise any right, email privacy@sico.software. We will respond within 30 days. You also have the right to lodge a complaint with the ICO at ico.org.uk.

Security

All data is transmitted over TLS. Our server (Hetzner, Germany) is access-controlled via SSH key and Tailscale VPN. Integration credentials and API keys are encrypted at rest using pgcrypto symmetric encryption.

Cookies

We use one strictly necessary session cookie to keep you logged in. We do not use advertising or tracking cookies. PostHog analytics uses a first-party cookie; it does not track you across other sites.

Changes to this policy

Material changes will be communicated by email and by updating the effective date above. Continued use of the service after notification constitutes acceptance.