Security
Facts about how sslcertificates.io stores secrets, isolates tenants, and accepts vulnerability reports. No SOC 2, ISO 27001, or pentest claims.
Transport and secrets
HTTPS is required in production. Application secrets and platform-generated private keys are encrypted with the Laravel application key. API tokens are stored hashed by Sanctum.
Tenant isolation
Every domain, certificate, webhook, and DNS integration belongs to an organization. API queries always include that constraint. Cross-organization reads return 403 or 404.
Private keys
Customer CSR mode: we never see the private key. Platform-generated mode: RSA or ECDSA keys are created on the server, encrypted at rest, hidden from list endpoints, and downloaded only through an audited route.
Reporting
See /.well-known/security.txt and the responsible disclosure section. We do not publish a placeholder mailbox. If SECURITY_CONTACT_EMAIL is unset, use the contact form and mark the subject as security.