How we handle your data

When you upload a PDF, the following happens on our server:

1. The file is validated for format, scanned for threats, and structurally inspected.
2. Four metadata fields are extracted: document ID, institution ID, document hash, and signature.
3. Only the document ID is sent to AcadCert to check the credential's validity.
4. The verification result is returned to you.
5. The PDF is deleted from server memory.

No document contents or the PDF itself are ever sent to AcadCert. The PDF is held in server memory (RAM) only during processing — it is not written to disk.

No accounts. No login. No cookies. No tracking pixels. No analytics that identify you. No document contents stored anywhere.

Your IP address is used for rate limiting and is not logged persistently. The PDF exists in server memory only during processing — typically under one second.

• Cloudflare — serves the website, provides DNS and DDoS protection.
• AcadCert — the credential registry that performs the actual verification.
• Railway — hosts the verification backend.

For privacy questions, email hello@acadcert.com