GDPR Compliance

How CredSure protects personal data and supports your obligations under the EU General Data Protection Regulation.

Lawful basis: We only process personal data with explicit consent or to fulfil a contractual obligation.

Data minimisation: We collect only the personal data strictly necessary to issue and verify a credential.

EU-based data residency available — all credential data can be stored exclusively within the European Economic Area.

Right to access: Data subjects can request a complete export of their data at any time.

Right to erasure: Recipients can request deletion of their personal data; we honour requests within 30 days.

Right to portability: Credentials can be exported in JSON, PDF, and Open Badges 3.0 formats.

Sub-processor transparency: A current list of all sub-processors is published and updated quarterly.

Data Processing Agreement (DPA): Available for all paid plans on request.

Breach notification: Customers are informed within 72 hours of any confirmed personal data breach.

Regular audits: Annual penetration testing and ISO 27001 audits validate our security posture.