Security and data

This page states what the product does with your data. The full list is on the security page.

Where data is kept

For website signups, certificate inventory and audit records are stored in the EU under Spot Cloud B.V. There are two exceptions. Encrypted private keys and credentials are held in Cloudflare Workers KV, which is not limited to EU locations. The hourly backup of the database is kept in Cloudflare object storage in Western Europe, under Cloudflare's default jurisdiction.

Separation between customers

On your own environment host (yourcompany.automate-certificates.com), certificate data is kept in a schema of its own, and a request that cannot be matched to a customer is refused. Accounts, sign-in sessions and API keys live in a shared central schema, where every query is filtered by organization.

Private keys

Private keys are encrypted with AES-256-GCM and stored apart from certificate records. The app decrypts a key in memory only to issue, renew or deploy its certificate, or when an admin exports it. If you send your own certificate signing request, the app never holds the private key.

Audit log

The audit log is in the app and records who did what and when: sign-ins, certificate requests, renewals, revocations, imports, key exports, deployments, target changes, API key changes and member changes. A failed renewal is recorded too.

When an issuance finishes after a DNS-01 or ACME wait, the audit log does not add a separate issued entry; use the cert.issued webhook event if you need a record of that moment. A CSV export of the log is available on request.

Legal

Automate Certificates is operated by Spot Cloud B.V., KvK 89708873, VAT NL865071536B01. Terms, privacy notice and the data processing agreement are on spot-suite.com.