Trust center

Built for organizations that take credentials seriously.

Credostar holds credentials that prove someone earned something. We treat that responsibility the way the underlying achievement deserves: with cryptographic integrity, audited controls, and architecture that does not require trusting us unconditionally.

This page is the single source of truth for our security posture. If you are evaluating Credostar for procurement, this is what you share with your security team.

Standards and certifications

Independently verifiable, independently audited.

W3C Verifiable Credentials

Every credential issued is a W3C Verifiable Credential. The cryptographic proof is part of the credential payload itself, not a lookup against our servers.

View the spec

OpenBadges 3.0

Native support for OpenBadges 3.0, the 1EdTech standard for skills-based digital badges, aligned with W3C VC.

View the spec

ISO 27001 certified

Information Security Management certification. Independent audit of how we manage information security risks across people, processes, and technology.

SOC 2 Type II (in progress)

Audit scheduled. SOC 2 Type II evaluates operating effectiveness of security controls over a defined period.

Security practices

What we do at every layer.

  • Encryption in transit and at rest

    All connections use TLS 1.3. Customer data is encrypted at rest using AES-256. Backups are encrypted with separately managed keys.

  • Credential signing keys

    Each issuer organization has a dedicated key pair for credential signing. Private keys are stored in a managed KMS and never leave the boundary. Public keys are published for verifiers.

  • Data segregation

    Workspaces are isolated at the data layer. Cross-workspace access requires explicit configuration by an organization administrator.

  • Access control

    Role-based access at the platform, reseller, organization, and workspace levels. Audit logs capture every credential issuance and every administrative change.

  • Audit logging

    Every credential issued, every template changed, every recipient added is logged with actor, timestamp, and IP. Retained for a minimum of 24 months on enterprise plans.

  • Tamper-evident credentials

    Any modification to a credential invalidates its signature. Verifiers detect tampering automatically; we do not need to be in the loop.

  • Blockchain tier (optional)

    Blockchain credentials anchor the issuance proof to a public chain for high-stakes credentials that need tamper-evident proof beyond traditional signatures.

  • Self-hosted verifier (Enterprise)

    Run a verification endpoint inside your perimeter so internal teams validate credentials without depending on a public endpoint.

Disclosure

Found something? Tell us.

If you have discovered a security issue affecting Credostar or any credential issued through the platform, we want to know.

Responsible disclosure

Email [email protected] with a description of the issue, reproduction steps, and your contact information. We acknowledge reports within one business day.

We commit to investigate every credible report, work with the reporter on a coordinated disclosure timeline, and credit researchers (with permission) once fixes are deployed.

[email protected]

Be one of our first design partners.

We're onboarding a small group of issuers ahead of our Q3 2026 launch. Help shape the product, get founder-level attention, and lock in launch-day pricing.

Apply for early access