How does CertH grade a TLS setup?

It sends a ClientHello to port 443, reads the certificate chain and negotiated parameters, weights protocol versions, cipher strength, key size, validity, hostname match and chain length into a 0-100 score, then maps it to A+ … F following SSL Labs semantics.

Does CertH store my data?

Only public TLS data is processed. After signup we keep just your email, watched domains, alert rules and hashed API keys; you can delete your data or close your account at any time.

Kebijakan privasi

CertH processes public data only: TLS handshakes and certificate metadata. No tracking cookies, no data sales.

Everything CertH processes is already publicly reachable by anyone on the internet: the contents of a TLS handshake. This page explains exactly what we record, who processes it, how long we keep it, and how you can ask us to delete it.

What we record

For each scanned domain we record: the domain itself, the scan timestamp, supported protocol versions, the negotiated cipher suite, and for every certificate in the chain its issuer, serial number, validity window, public key algorithm and length, hostname match, plus HSTS/OCSP deployment state. This mirrors what Certificate Transparency logs publish and what a browser sees anyway.

What we never do

We never try to log in, escalate privileges or bypass access controls; we never request, receive or store any private key; we never collect page content, forms or images; we do not track you across sites, build personal profiles, or sell data or use it for ad targeting.

Account & API data

After signup we store only: your login email, the list of domains you watch, alert rule configuration and API call records. Sign-in and sessions are handled by Clerk, a third-party identity provider — we never see your password. API keys are stored hashed and shown in plaintext once, at creation. You can delete watched domains or close your account at any time.

Cookies & analytics

This site sets no tracking or advertising cookies. A few pages carry affiliate links (for example, to SSL certificate vendors); if you click one, the vendor may set its own cookies under its own policy. Those links never affect our grades, and we receive no personal data about you from them. Language and theme preferences live in your browser's localStorage solely to remember your choice on that device. If Google Analytics is enabled, it is used only for anonymized traffic statistics (IP anonymization on).

Who processes it

Hosting, CDN and caching: Cloudflare (Workers / KV / edge cache). TLS and certificate probing: performed by one dedicated scan node we operate ourselves. Traffic analytics: Google Analytics (IP anonymized). Sign-in and sessions: Clerk. Alert emails: delivered by a third-party email service. Each of these parties handles data under its own privacy policy.

Retention & your rights

Leaderboard and domain snapshots are kept for at least 365 days; the public history endpoint truncates to the most recent 45 days on the free tier, the 30-day trend chart is drawn from that history, and badge results are edge-cached for one hour; access logs are retained briefly and then cleared. Email certh@csr.plus to request export or deletion of everything tied to your account — we usually complete the request within 1–2 business days.

Ads & affiliate links

Some pages (the home page and the sidebar of domain reports) contain affiliate links labelled "Advertisement". Our current partners are Namecheap (SSL certificates) and UptimeRobot (uptime monitoring). If you click one, the vendor may set cookies and record the referral under its own privacy policy; we receive only aggregated commission data, never your name, email or payment details. Advertising never affects any domain’s score, grade or leaderboard position — grades are derived solely from TLS handshake probes.

Last updated: 2026-11-03