Certn

The Certn connector files evidence that new joiners were background-checked. It reads Certn’s current API (CertnCentric); the legacy api.certn.co API was shut down on 5 August 2026 and is not supported.

What it collects

Background checks for joiners (joiner-checks, monthly, covers the window since the last run).

1. Joiners are the people the People directory first recorded in the window (Admin → People). “Joined” is the date the directory recorded them, not an HR start date.

2. For each joiner with an email, Proofroom asks Certn for the cases ordered for that email (matched without regard to case). The newest case decides.

3. Each joiner gets one outcome:

   Outcome	Meaning
   Completed on time	The case is complete, no later than the join date plus the grace days.
   Completed late	The case is complete after that, or Certn gives no completion date.
   In progress	The case is still open (ordered, invited, in progress, waiting on someone, in review or in dispute).
   Drafted in Certn, not yet ordered	The case is a draft (DRAFT): no invite has gone to the applicant.
   Cancelled, declined, expired or superseded	The case closed without a result: cancelled, the applicant declined, the invite expired or could not be delivered, or the case was replaced by a re-run.
   Unknown Certn status	Certn sent a status that is not in its published list. It is neither open nor complete; look at the case in Certn.
   No check found	Certn has no case for the joiner’s email.
   No email	The directory holds no email for the joiner, so nothing can be matched.

Open cases are followed up. A joiner whose case was still open (in progress, drafted or with an unknown status) at the previous run is looked up again by every later run, listed under “Earlier joiners re-checked” with the outcome it has now. When the case completes, that run’s evidence shows it and the person’s “Filled by Certn” employee-file item is filled, as for a case that completed in its own window. Follow-ups stop 180 days after joining; open cases older than that are listed under “Open cases no longer re-checked” so they can be chased by hand. The follow-up list comes from the newest submitted or accepted evidence of this collector, so submit each month’s evidence before the next run; a draft is not read.

Not checked, and listed separately: people in an excluded department or excluded by hand on Admin → People, and everyone recorded by the install’s first directory read (people already employed; counted as “baseline”).

A person who joined as new after a directory source switch, because their email did not match their old record, is a joiner like any other and will usually show “Completed late” or “No check found”; check those by hand.

Stored: the joiner’s name and email (for joiners and re-checked earlier joiners), the join date, and the newest case’s id, status, check types, creation date and completion date. Never stored: scores or adjudication (overall_score), per-check results, reports, addresses, dates of birth, or any other applicant detail.

The run fails, and retries the same window next time, when no directory source is chosen, when the directory has never been read, or when its latest read is older than the freshness limit on Admin → People. An empty joiner list from a directory that is not syncing would otherwise look like clean evidence.

Suggested controls: PCI DSS 12.7.1; SOC 2 CC1.4.

Setting it up

1. In Certn’s Client Portal, open Settings → Integrations and create an API key. Keys belong to one region and expire after 365 days. Create the replacement key before the old one expires and edit the integration to use it.
2. In Proofroom, Integrations → Catalogue → Certn → Connect, and fill in:
   • Region: ca for North American accounts, including the US (https://api.ca.certn.co; Certn has no separate US host), uk or au. A key only works in the region that issued it.
   • Sandbox: on only for Certn’s sandbox hosts.
   • API key: the key from step 1. It is sealed at rest and shown only as a fingerprint.
   • Grace days (default 0): how many days after joining a completed check still counts as on time.
3. Press Test connection. A refused key reads “Certn refused the API key”; check the region and expiry.
4. Enable Background checks for joiners, add the suggested controls to your audits, and save.

Proofroom paces its requests under Certn’s limit of 60 a minute, so a month with many joiners takes about a second per joiner and per open case re-checked. A run that runs out of time fails and retries the same window; it never files part of the list.