> ## Documentation Index
> Fetch the complete documentation index at: https://docs.superoffice.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Certification checklist

> Certification checklist

My application is ready, what should I consider before I ask for a certification test?

## Security

* All [redirection URLs][1] and all URLs embedded in web panels are secure: run Qualys SSL Labs - [SSL Server tests][2] and aim for an A
* SSL 2.0 and 3.0 are disabled
* TLS 1.2 is supported
* All data is [validated on input][3] and escaped on output
* The application uses [federated authentication][4] and [validates all tokens][5] received from SuperOffice

[1]: ../create-app/config/redirects

[2]: https://www.ssllabs.com/ssltest/analyze.html

[3]: https://owasp.org/www-project-cheat-sheets/cheatsheets/Input_Validation_Cheat_Sheet

[4]: ../../online/identity/federated-auth

[5]: ../../api/authentication/online/validate-security-tokens

* Absolutely no user credential authentication information is stored in your application
* [Visibility restrictions][16] are preserved when you copy data. For example, copied documents with private visibility must remain intact.

## Provisioning

* Workflow for giving [consent to the tenant][17] is implemented
* The installation process must programmatically set up all elements such as web panels and user-defined fields. Administrators should not have to manually configure any elements post-installation.

## Error handling

* The application handles scenarios where access to the customer's database is lost, such as when the [application is revoked][18]. Check the [tenant status page][19].
* Have an error handler page. Don't expose your code and display the "Yellow screen of death".

## Protect your web panels

* Information doesn't leak via web panels (and thus forwarded to others who are not authorized)
* The context identifier template variable (`uctx`) and also the User login associate ID (`usid`) are part of the URL of all web panels you add
* `usec` is **never** passed as a parameter in the URL

- Visibility is set to **all user groups** by default
- The application name and/or your company name is part of the web panel's description

## Cookies

* The `Secure` and `HttpOnly` flags are set

## Limit your searches

* API calls don't choke the database
* Ensure the user types at least 3 characters before you start searching for contacts, persons, email addresses, selections, and similar

## System user and important rules

* Never rename the **owner company** (`contact.name` field for the company with `contact_id` found in the Company database table). If you do, our license check fails and all users are locked out!
* Persons may be associates - if they have a row in the associate table then
  * don't update a person's company (`person.contact_id`)

<Danger>
  You **must** protect the customer database from total destruction, which will require Online Operations to update the database manually. Use the [system user][1] with great caution.
</Danger>

[1]: ../getting-started/user-contexts

## GDPR - creating persons

* When you create a new contact person, you should allow the customer to choose from their own list of [Privacy - Source][11], but you must set a default value - **Other integration** with key **API** so it is never left as unknown

## GDPR - marketing consent

* The application checks the contact person's [e-marketing consent][12] before sending out e-marketing mailings

## Language support

* For [multi-lingual support][3], add list items on the **NO: "Bil", US: "Car"** format

## Logging

* You have [enabled logging and keep the logs][4] for at least the minimum amount of time, 3 months

## Maintenance window

* You will handle unavailability scenarios such as when CRM Online is not available

## Tenants

* The application [checks the status page][19] of the customer's tenant before performing actions  to ensure stability

## Requirements by category

* [Business][5]
* [Security][4]
* [Design][6]
* [Marketing][7]
* [Technical][8]
* [Localization][3]

## I'm good to go!

[Sign me up for certification][1]

[1]: ./certify-app

[3]: ../requirements/localization

[4]: ../requirements/security

[5]: ../requirements/business

[6]: ../requirements/design

[7]: ../requirements/marketing

[8]: ../requirements/technical

[17]: ../../provisioning/get-consent

[18]: ../../provisioning/revoke

[19]: ../../best-practices/tenant-status/check-status

[16]: ../../../admin/user-management/index#visible

[11]: ../../../security/privacy/consent-management

[12]: ../../../security/privacy/e-marketing-consent


## Related topics

- [Submit standard app for certification](/en/developer-portal/standard-app/certification/certify-app.md)
- [App Store Partner logo and brand guidelines](/en/developer-portal/standard-app/requirements/partner-brand-guidelines.md)
- [Validation checklist](/en/developer-portal/custom-app/checklist.md)
- [ChecklistAppointment](/en/api/archive-providers/reference/checklistappointment.md)
- [About Telenor Cyberdefence initial security evaluation](/en/developer-portal/standard-app/certification/initial-security-eval.md)
- [Security requirements](/en/developer-portal/standard-app/requirements/security.md)