Trust & Compliance

Security you can
verify, not just trust

Credentic is built to meet the standards your legal, IT security, and data governance teams require. Here is exactly how we protect your institution and your students.

§Section 1  ·  Regulatory Compliance

Compliant across
every jurisdiction we operate in

We design our data handling to meet the requirements of every regulatory framework applicable to our partners.

🇬🇭
Ghana Data Protection Act

Credentic is certified by the Ghana Data Protection Commission. We comply fully with the Data Protection Act, 2012 (Act 843), ensuring lawful processing, storage, and transfer of personal data originating from Ghanaian institutions and citizens.

Act 843Ghana DPC CertifiedLawful Processing
🇪🇺
GDPR Compliance

Our data handling practices meet the requirements of the EU General Data Protection Regulation and UK GDPR. We act as a data processor — your institution remains the data controller. Data Processing Agreements are provided to every partner.

GDPRUK GDPRData Processor
🇺🇸
FERPA Compliance

For US-based institutions, Credentic operates within the FERPA framework. Student education records are only accessed with explicit, logged consent. We never access records without a valid consent event, and all access is auditable.

FERPAConsent-GatedAuditable
§Section 2  ·  Encryption & Infrastructure

Defence in depth,
at every layer

Every piece of data that enters Credentic is encrypted, access-controlled, and subject to strict retention policies.

Data at rest
AES-256 encryption across all storage
Data in transit
TLS 1.3 enforced on all connections
API authentication
OAuth 2.0 with rotating credentials on a 90-day cycle
Key management
Hardware Security Modules (HSM) for cryptographic key storage
Access control
Role-based access with multi-factor authentication required
Penetration testing
Annual third-party penetration testing with remediation SLA
Credential revocation
API credentials can be revoked instantly by your institution
Data retention
Retrieved records deleted within 24 hours of verification completion
§Section 3  ·  Data Principles

How we handle
your data

01
Consent first

No student record is ever queried without an active, logged consent event. Consent is a hard gate — if a student does not grant it, no query is sent. Period.

02
Minimal data

We only retrieve the specific data fields required for verification. No bulk extracts, no data hoarding, no secondary use. Your DPA defines the exact scope.

03
Institution control

Your institution retains full control. You define what data is accessible, set rate limits, and can revoke API access instantly from your dashboard at any time.

04
Transparent deletion

All verification data is deleted from Credentic systems within 24 hours of completion. On partnership exit, all cached data is purged within 7 days with written confirmation.

Ready to review our
compliance documentation?

We provide full DPA, security documentation, and Ghana Data Protection Commission certification upon qualified enquiry.

Sign In