AutoCertify's whole job is trust, so we hold ourselves to the standard we sell. This page describes what's genuinely true about how we issue certificates, handle keys, authenticate access and treat your data — no aspirational claims, no borrowed logos.
Every certificate is a publicly-trusted, domain-validated (DV) TLS certificate issued through Cloudflare for SaaS and its Managed CA. There are no self-signed shortcuts and no private, untrusted roots — the same certificates a browser trusts everywhere else on the web.
A domain is marked active when Cloudflare confirms both the custom hostname and SSL certificate are active. That saved status reflects the last provider check. Refresh to retrieve its current state and verify the routed website's HTTPS connection separately.
The provider request contains the hostname and certificate settings needed for managed issuance. The application also stores workspace, account, DNS, certificate, billing-reference and operational records to provide its features. The privacy policy describes these categories and their use.
Cloudflare manages the edge certificate and private key. AutoCertify does not offer PEM or private-key export for these managed certificates. The public dashboard and API use HTTPS; your website must route through the configured service to use the certificate.
The portal authenticates through Auth0; its session bearer is an ID token verified against the issuer's JWKS and configured client ID. Programmatic requests use ac_live_ API keys. Owner or admin human sessions are required to create, rotate or revoke credentials and manage team access.
Each outgoing webhook uses HMAC-SHA256 and a per-endpoint secret. Verify the signature over the timestamp, a period and the exact raw request body, reject stale timestamps, and deduplicate delivery IDs before processing retries. The webhook guide includes a complete receiver.
Domain, certificate and credential operations write audit events with their actor, action, target and timestamp. Authenticated workspace queries expose this history for operational review and troubleshooting.
Cloudflare manages certificate renewal while the hostname remains eligible. AutoCertify provides DNS rechecks and provider refresh endpoints so you can retrieve current results. Schedule these calls in your integration when you need regular monitoring; outgoing certificate events cover initial issuance.
A green badge is only meaningful if you can trust it. AutoCertify treats issuance as a chain of real, verified checkpoints — and reflects exactly where a domain sits at each one.
DNS lookups must confirm both the delegation CNAME and the ownership TXT tied to your workspace.
Cloudflare reports the custom hostname itself is provisioned and active on the edge.
The certificate is issued and its SSL status is confirmed active — both conditions must hold before anything reads secured.
Recheck validates DNS again and refresh retrieves current provider state. Website traffic must route through the configured Cloudflare service.
We're grateful to researchers who report issues privately and give us a chance to fix them. If you believe you've found a vulnerability in AutoCertify, please tell us before you tell anyone else.
Email a description of the issue, the steps to reproduce it, and anything we'd need to understand the impact. The more detail you can share, the faster we can confirm and fix it.
security@autocertify.netOn what we don't claim. We'd rather be precise than impressive. This page describes controls that are in place today; where we're still maturing a practice we'll frame it honestly rather than imply a certification we don't hold. Have a specific security or compliance question for your team's review? Ask us directly and we'll give you a straight answer.