Security & Compliance

Built for regulated financial institutions.

Privacy-first by architecture. Compliance-ready for FCA, GDPR, and ECOA. Institutions receive verified claims, not raw financial data. Zero-knowledge proofs as default.

Plaid partnership for secure account connectivity Open banking intake without raw statement sharing PASSID verification protocol for regulated institutions Plaid partnership for secure account connectivity Open banking intake without raw statement sharing PASSID verification protocol for regulated institutions

Certifications

🛡️

SOC 2 Type II

Annual audit. Security, availability, and confidentiality trust service criteria.

📋

ISO 27001

Information security management system. Certified annually.

🇪🇺

GDPR Art. 22

Automated decision-making compliance. Human review pathways. Data minimisation by design.

⚖️

ECOA / FCA

Fair lending monitoring. Disparate impact ratio tracked per corridor. Bias audit trail.

Swipe to reveal

Architecture

Zero raw PII. By design.

🔐 Zero-knowledge proofs

Groth16 proofs allow users to prove income thresholds, DSCR bands, and payment streaks without revealing the underlying data. Lenders receive cryptographic evidence, not raw statements.

🗝️ Ed25519 signing

Every credential is signed by PASSID's issuer key. Institutions verify the signature before trusting any claim. Tamper-evident from issuance to presentation.

📱 On-device key storage

Private keys never leave the user's device. PASSID cannot revoke on behalf of a user without their consent. Cryptographic revocation list maintained on-chain.

🏗️ Data minimisation

Open banking data is processed transiently to produce credential claims. Raw transactions are never stored. Only the claim (e.g. "income_above_£2000") is persisted.

🔍 Full audit trail

Every verification event, consent action, and credential lifecycle change is logged with millisecond timestamps. Exportable for regulatory review.

🌍 Encrypted at rest + transit

AES-256 at rest. TLS 1.3 in transit. Regional data residency options for EU, UK, and US deployments.

Responsible disclosure

Found a vulnerability?

We operate a coordinated disclosure programme. Report security issues to sales@passid.io. We respond within 24 hours.

Scope

API endpoints, credential issuance, verification logic, wallet app, webhook delivery, and authentication.

Response SLA

Acknowledgement within 24h. Severity assessment within 72h. Critical fixes within 7 days.

Recognition

Valid reports acknowledged in our security advisories. Bug bounties available for critical vulnerabilities.