The protected core

Your certificate: the report data, verification key, and any photo you submit. Every outer layer exists to keep this safe.

Verification keys are never stored in plain text

Every verification key is one-way hashed (argon2id) before it touches our database. Even we cannot retrieve or read the original key. Only the report itself can be matched against it.

No reports sit in an open folder

Certificates are generated in server memory and uploaded directly to private cloud storage. There is no public directory of past reports. Each download link is signed and expires within minutes.

Rate-limited verification, on top of bot protection

The public verification page enforces a strict attempt limit per visitor, with escalating cool-down periods, in addition to Cloudflare Turnstile screening on every form.

Sample photos are stripped of hidden data

Every uploaded photo is automatically re-processed to remove EXIF metadata, including GPS location and device information, before it is stored or embedded in any certificate.

Authenticated email domain

Our domain is configured with SPF, DKIM, and DMARC, email authentication standards that make it far harder for anyone to send a convincing message impersonating Convalence Labs.

Data hosted within the European Union

Our database and infrastructure are hosted in EU data centres, in line with GDPR principles for data handling and residency.

Payments processed through our own Bitcoin infrastructure

We accept Bitcoin payments through our self-hosted, non-custodial payment server, hosted within the European Union. No third party ever holds or processes a payment on our behalf. We store only a payment reference linked to your order, never card or bank account details.

Encrypted in transit, always

Every connection to convalencelabs.com, whether browsing, submitting a request, or downloading a certificate, is encrypted in transit (HTTPS/TLS), enforced site-wide.