Privacy Notice

Who handles your information

RymarisCerts is a Soligent, Inc. service. Contact support@rymariscerts.com for service help, or rymariscerts@soligent.com about account information or privacy requests. This notice describes the current portal, including early-access features; live payments are not enabled.

Account and security information

We store your name, email address, selected plan, password hash, encrypted authenticator secret, hashed single-use recovery codes and account security records in SQL Server. Source IP addresses are recorded for the account and IP lockout system.

We store the versions and fingerprints of the Terms of Service and Privacy Notice you accept, the acceptance time and whether you accepted during registration or an account review. Accepting the Terms and acknowledging this notice does not consent to optional Google Analytics.

Account email tokens are protected before entering the mail queue. Account messages use the configured email service. Do not send passwords, authentication codes, recovery codes or private keys in support requests or ordinary email.

Certificate and service information

We store domain names, public certificates, certificate observations, issuance and activity history, subscription metadata and the service requests you submit. If you request certificate creation, we also store the public signing request, validation instructions, encrypted certificate private key and order history. Certificate-authority account keys are encrypted separately.

Private-key package passwords are used to protect the particular download and are not stored. Native automatic-renewal clients retain private keys on your server; the portal does not receive those native client keys.

How information is used and processed

Information is used to provide the certificate workspace, validate authorized account actions, issue requested certificates, prepare protected downloads, communicate about account and key security, investigate service problems and maintain service records.

Microsoft Azure hosts the production application and SQL database. The configured email service processes account messages, the chosen certificate authority processes issuance and validation requests, and Google processes optional public-page Analytics after consent. Your own DNS or hosting provider may process actions you perform there. We do not place private keys, authentication secrets or form contents in Analytics.

Certificate and private-key retention

We retain public certificate records and account history while your account exists. Portal-managed private keys are encrypted and retained while their certificates are valid. They become eligible for removal 30 days after certificate expiry.

Before removal we submit a transactional security notice to your confirmed account email address, with a final protected-download opportunity at least seven days before removal. Failed or delayed notices delay removal. Downloads continue to require fresh two-factor verification and your own package password. The issued-request dashboard shows retention dates and whether automatic processing is enabled.

Removing an expired key does not delete the public certificate or its history, revoke the certificate or change your server. Native client keys, certificate-authority account keys, wrapping certificates, protection keyrings and private configuration are outside this expired customer-key removal policy. After removal, request a new certificate instead of trying to reformat the old key.

Removal from the active database is not immediate erasure of recovery backups. Older encrypted database copies age out under their separate configured retention policy. Copies you download or keep on your own server are under your control. Contact us for account and data requests; ownership must be verified before private account information is released or changed.

Essential browser storage

The service uses essential cookies for account sessions and protection against forged form submissions. A local preference remembers your optional Analytics choice. These functions are separate from optional Analytics cookies.

Optional public-page Analytics

Google Analytics loads only after you allow it on a public information page. Declining sends no Analytics requests. Use Privacy settings in the footer to change your choice. We honor a browser Global Privacy Control or Do Not Track signal.

Account pages, authentication, certificate packages and form contents are excluded. Only the fixed public page path and title are included in our page-view measurement; query strings and referrers are removed. Google may process device and browser information and use Analytics cookies after consent. Do not enter private information into public URLs. Advertising personalization is not enabled by this consent.

Requests and changes

Contact rymariscerts@soligent.com about access, correction, account closure, retained information or a privacy concern. Do not include private keys, passwords or authentication codes. We may ask you to verify account ownership through a secure process. Applicable rights depend on your location; this notice does not limit rights that cannot lawfully be limited.

We publish the current notice with a version and date. When an account review requires a new acknowledgment, it is recorded explicitly rather than inferred from old activity. Optional Analytics consent remains a separate choice.