Passify

Security & Architecture

How Passify handles data and what security controls are implemented.

Data Architecture

Passify never stores, processes, or transmits personal identity data. The architecture is deliberately minimal:

┌─────────────┐     ┌──────────────┐     ┌─────────────┐
│  Investor   │────▶│  KYC Provider │────▶│  Provider   │
│  (browser)  │     │  (Blockpass)  │     │  Database   │
└─────────────┘     └──────┬───────┘     └─────────────┘
                           │ webhook (approved/rejected)
                           ▼
                    ┌──────────────┐     ┌─────────────┐
                    │   Passify    │────▶│   Solana     │
                    │   (server)   │     │  (on-chain)  │
                    └──────────────┘     └─────────────┘
                           │
                    Stores ONLY:
                    • SHA-256 hash of KYC result
                    • Solana public key
                    • Attestation metadata
                    • Expiration timestamp

What We Store vs. What We Don't

We store

  • Solana public keys
  • SHA-256 attestation hashes
  • On-chain transaction signatures
  • Compliance rule configurations
  • Audit logs of all actions

We never store

  • Names, addresses, DOBs
  • Government IDs or SSNs
  • Biometric data
  • Bank account details
  • Photos or document scans

Infrastructure Security

Encryption
TLS in transit (version depends on deployment). Encryption at rest depends on hosting provider configuration.
Authentication
bcrypt passwords. JWT sessions with revocation.
Rate Limiting
Redis-backed. Fail-closed in production.
Account Security
Lockout after 10 failed attempts. Session revocation on password change.
API Keys
SHA-256 hashed. Shown once. Monthly quota enforcement.
Audit Trail
Every action logged with actor, timestamp, and before/after values.
Error Tracking
Structured server-side logging with a unique request ID on every response.
Headers
CSP, HSTS, X-Frame-Options, Permissions-Policy.

Compliance Posture

Passify is designed to support platforms subject to AML/KYC requirements without becoming a regulated entity itself. We do not process or store PII — the KYC provider (e.g., Blockpass) handles identity verification and data retention. Passify acts as an attestation layer, recording only the cryptographic proof that verification occurred.

This architecture means platforms using Passify do not need to store or process investor PII directly.

Questions?

For security inquiries, vulnerability reports, or compliance questionnaires: security@passify.biz