What we do not claim
WatchMyCover is not SOC 2 certified and not ISO 27001 certified. No third-party penetration test has been carried out. If your procurement process needs a certification, we do not have one to give you.What is in place
One customer cannot reach another
One customer cannot reach another
Every request is scoped to your organization, re-read from the database each time, and cross-organization access is covered by tests.
Documents are private
Documents are private
Certificate files are held in a private bucket with no public addresses. Every download goes through the app, is checked against your organization at that moment, and is recorded in the activity log. Only PDF, PNG and JPEG files are accepted, judged by their contents, up to 10 MB.
Confirmed addresses and two-factor sign-in
Confirmed addresses and two-factor sign-in
Accounts confirm their email address before using the app. Anyone can turn on two-factor sign-in with an authenticator app and ten single-use backup codes; five wrong codes lock the account for 15 minutes.
Sessions
Sessions
Session cookies are httpOnly and secure. Permissions are re-read on every request, so removing someone takes effect immediately. A password reset link works once, expires after an hour, and signs out every other session.
An audit trail
An audit trail
Every change is recorded: vendors, certificates, templates, projects, the team, share links, chasing, sign-ins, password and two-factor changes, document downloads and register exports. See Activity log.
Links that are credentials
Links that are credentials
Upload links, report links and invitations are long random tokens; only a hash is stored. Upload links in chase emails are created as each email is sent. Archiving a vendor withdraws their upload links. Report links expire within 90 days and can be revoked; upload and report links stop if the account is canceled.
Rate limits and input checks
Rate limits and input checks
Sign-in, registration and password reset are rate limited, as are reads, writes, imports and exports. Every request is validated. CSV imports are capped at 4 MB and uploaded files at 10 MB.
Exports cannot run formulas
Exports cannot run formulas
A CSV cell beginning with a formula character is escaped, so an exported register cannot run a formula when opened.
What is not in place yet
- Two-factor sign-in is optional. An owner cannot yet require it of the team.
- Roles are broad. Any member can import vendors, archive them and export the whole register. See Team and roles.
- Two smaller gaps. Subscription changes from the payment provider are applied but not recorded, and a single upload link cannot be withdrawn on its own: archiving the vendor withdraws them all.
- Inline styles are allowed by the browser security policy.
Privacy in brief
- What is collected: your name, work email and company; what you enter (vendors, contacts, insurers, policies, limits, dates, templates, projects, verdicts); certificate documents you or your subcontractors upload; sign-in records, audit rows and server logs.
- Your subcontractors’ data is held on your behalf and used only to do what you asked: check certificates, email for renewals, produce the reports you share. It is not used to market to them.
- Not sold, not shared with advertisers. There are no advertising trackers.
- Analytics: PostHog, US-hosted, with no cookie, no browser storage, no session recording and no automatic capture of clicks or typing. Events carry identifiers, counts and statuses only, never names, email addresses, certificate values or document contents. Pages whose address carries an upload, report, invitation or reset token send nothing.
- Service providers: Vercel, Render, Neon, Resend, PostHog and Stripe.
- Retention: superseded certificates are kept, because the history is what an audit asks for. Ask us to delete a closed workspace and we remove it, including documents, within 30 days, except what we are legally required to keep.