Security

Last updated 24 October 2026

Passports are legal records that must stay correct and available for years. These are the measures we take to protect them.

How we protect passports

• Append-only history. Records change only by adding events. Each event stores a hash of the previous one, so tampering is detectable.
• Separated public pages. Public pages are served independently from the dashboard, so scans keep working during an incident.
• Backups in two locations. Daily backups with point-in-time recovery, plus an encrypted copy with a second provider in the EU. Restores are tested monthly.
• Least-privilege access. Row-level isolation between customers, role-based permissions, and scoped API keys stored only as hashes.
• Logged restricted access. Every view of level 2 or 3 data records who, when and which passport.
• Account security. Two-factor login, encryption in transit (TLS) and at rest.

Reporting a vulnerability

If you believe you have found a security issue, open a Security ticket with the steps to reproduce it. Please give us reasonable time to fix it before disclosing it publicly, and do not access or change data that is not yours. We will confirm receipt within two working days and keep you informed.