Security

Passify is built so that the most sensitive data simply never reaches it. This page explains the architecture that makes that true and the controls around everything else.

The zero-PII guarantee

Passify never stores, processes, or transmits personal identity data. Your KYC provider verifies identity and retains the underlying documents; Passify records only a one-way hash and the metadata needed to enforce policy. There is no PII to leak because there is no PII to begin with.

Data flow

where data lives

Investor ──▶ KYC provider ──▶ provider's database   (PII lives here, not at Passify)
                  │ webhook (approved/rejected)
                  ▼
              Passify ──▶ Solana (on-chain)   stores ONLY:
                                              • SHA-256 hash of the KYC result
                                              • wallet public key
                                              • schema + expiration
                                              • attester public key

What we store

We store

Solana public keys
SHA-256 attestation hashes
On-chain transaction signatures
Compliance rule configurations
Audit logs of every action

We never store

Names, addresses, dates of birth
Government IDs or tax numbers
Biometric data
Bank details
Document scans or photos

Controls

Area	Control
Transport	HTTPS only, HSTS enforced.
API keys	SHA-256 hashed at rest; shown once; per-integration scoping.
Webhooks	HMAC signature required — unsigned payloads are rejected.
Key custody	User private keys never touch Passify; only unsigned transactions are returned.
Rate limiting	Redis-backed; fails closed in production.
Audit	Every privileged action logged with actor, timestamp, and before/after values.
Headers	CSP, X-Frame-Options, and Permissions-Policy set at the edge.

Reporting a vulnerability

Report security issues to security@passify.biz. Include reproduction steps and the request ID from any relevant response. Please give us a reasonable window to remediate before public disclosure. See also the production checklist.

Last updated June 30, 2026