Security & privacy
Certificates, lab reports, supplier relationships, filing history — the data in EntryCert is commercially sensitive by nature. Here is, concretely, how it's protected. No vague reassurances; every claim below describes how the product actually works today.
The core of it
A vendor signing in sees only its own products and submissions. Who they are comes from their sign-in session, never from anything in a link or a form they could tamper with — and the check happens on our servers, on every request. There are no supplier names in URLs to guess. Anything outside their own scope is refused.
Everyone — your team and your vendors — signs in with one-time email links and codes. There is no password database to breach, nothing for a factory to write on a sticky note, and one less credential set for your organization to manage.
Sign-ins, edits, approvals, rejections, filings — every consequential action is recorded with who did it and when. When a certificate reaches a federal registry, you can reconstruct exactly how it got there.
Lab reports live in private storage that only signed-in, authorized users of your account can open — never public links, never shared between vendors, and your internal review notes are never shown to factories.
Lab-report analysis runs through an AI API under terms where your documents are not used to train models. The AI selects citations from a closed list of CPSC codes rather than transcribing freely, a failed test is always surfaced and never presented as certifiable, and the analysis treats your documents as evidence to check — text inside a document can't instruct it. What persists is the result in your account, not an AI copy of your report.
The database is backed up nightly to separate infrastructure, encrypted (AES-256) before it leaves, with 30 days of history. A restore path is documented and part of the design, not an afterthought.
Support access
Most SaaS vendors can silently open any customer account. EntryCert's own operators can't: support access to your account requires a fresh email confirmation at that moment, shows a visible banner in the interface for as long as it's active, and writes both the start and the end to your audit trail. If we've been in your account, your own records show it.
Around the product
Billing runs on Stripe. Card details are entered on Stripe's systems and stay there — full card numbers never reach EntryCert's servers.
This website and the vendor portal load zero third-party scripts — no analytics tags, no ad pixels, no CDN assets. That's why the portal works from China, and it also means no tracker ever sees your team's or your vendors' activity.
Certificates go to the CPSC Product Registry under your own certifier account, at your direction, with per-product results returned. EntryCert never files on a shared platform account, and a filing that didn't happen is never shown as one that did.
Straight answers
No. Vendor identity is derived from the signed-in session on our servers, and every read and write is scoped to that vendor. There is no link, parameter, or setting a vendor could change to reach another vendor's data — out-of-scope requests are refused outright.
No. Lab reports are analyzed via an AI API under terms where API data is not used for model training. The saved output is the analysis result in your account; your documents themselves stay in your account's private storage.
In the United States — the application is hosted on Render and data lives in Supabase (Postgres and private document storage), with encrypted nightly backups. The Privacy Policy lists every provider we use and what each one does.
Not silently. Support access requires an email confirmation at the moment of access, is visibly bannered while active, and is written to your audit trail — start and end. See Even we knock first above.
Yes. Your data is yours — export is available at any time, and the Terms of Service (§8) commit to it contractually, including at termination.
See it yourself
Every claim on this page is demonstrable on real screens — vendor walling, the audit trail, the support-access confirmation, all of it.