SECURITY

How records are protected, and what they prove

A Certi.parts record makes changes evident and leaves a trail. It can’t prove a part is good, so it doesn’t claim to.

What we never receive

Design files. Your browser computes a fingerprint and the file stays on your device.

What a signature means

A valid signature shows a record hasn’t changed since it was signed. It doesn’t show that a part conforms, or that a measurement is true. Each record says where its readings came from.

Selective sharing

Each section of a record is signed separately by its salted fingerprint. A buyer receives the sections you choose, plus any their baseline requires, and can verify them without seeing the rest. Withheld sections show as withheld.

Verify a record yourself

Our public signing keys are at /.well-known/certi-keys.json. Check a downloaded bundle against those keys, not against any key inside the file itself: a key inside a file proves nothing.

Current limits

• Certi.parts signs records as a platform, so you trust us to record what parties declared.
• Inspection readings are entered by the shop unless a record says otherwise.
• A QR label identifies a record, not a physical part.

Standards

ISO 9001:2026 was published on 16 September 2026. Our clause references follow ISO 9001:2015 until they have been reviewed against the new edition. Superseded by ISO 9001:2026. Accredited 2015 certificates must transition by 30 September 2029. Certi.parts doesn’t certify your organization.

Report a problem

Email security@sico.software.