Trust

Security at Passmint

Last updated July 15, 2026

Overview

Passmint is a developer platform for issuing Apple Wallet passes. This page describes how we handle customer and end-user data, how we protect customer-provided signing credentials, and the infrastructure we run on. It is updated as our security posture changes. See the timestamp above.

Enterprise buyers can request our full security package (DPA, current subprocessor list, and responses to common security questionnaires) by emailing security@passmint.com.

Data handling

Passmint processes three kinds of customer data, each with a different retention policy.

Account data: Organization details, user accounts, API keys, billing contacts.
Pass content: Templates you author and the field values, barcodes, and assets you issue into passes.
Pass-holder data: End-user information you pass through for pass issuance, typically name, email, or whatever fields your template defines.

What we do not store

Payment card numbers. Billing is handled directly by Stripe; Passmint never receives card data.
End-user passwords. Passmint has no end-user accounts. Pass holders interact with Apple Wallet, not Passmint.
Pass-holder data beyond what you send us. We do not enrich, purchase, or collect additional end-user information.

Data residency

All customer data at rest is stored in the United States. The primary application database (PlanetScale) and its Cloudflare Hyperdrive connection layer, the Cloudflare R2 buckets holding pass assets and encrypted certificate material, and our AWS KMS key-management service all run in US regions. Request processing runs on Cloudflare's global edge network, so a request is handled at the location nearest the caller, then read through to US-hosted storage.

Retention

Data	Retention
Account data (organization, users, billing)	Retained for the life of the account; deleted within 30 days of account closure.
Templates and issued passes	Customer-controlled. Deleted immediately on request via the dashboard or API.
API request logs	30 days, then purged.
Webhook delivery logs	30 days, then purged.
Authentication & security audit events	365 days.
Encrypted database backups	30 days.

Credentials & certificates

The most sensitive material Passmint holds is your Apple PassKit signing certificate. Apple requires every pass to be signed with a certificate issued to your Apple Developer team, so the private key that signs on your behalf must be available to our issuing service at runtime. We treat that constraint with care.

How private keys are stored

When you upload a signed .cer from Apple, the corresponding private key (PKCS#8 PEM) is envelope-encrypted before it ever touches durable storage:

A fresh 256-bit data encryption key (DEK) is generated in memory for the upload.
The private key is encrypted with AES-256-GCM using that DEK (12-byte IV, 16-byte authentication tag).
The DEK is wrapped by our AWS KMS customer master key. The plaintext DEK is zeroed in memory immediately after wrapping.
The encrypted private key and the KMS-wrapped DEK are persisted to the database. Neither value is useful without access to the KMS key.

The signer certificate (.cer) and Apple's WWDR intermediate are stored in Cloudflare R2. These are public certificates, not secrets.

Who can access them

No Passmint employee has standing access to customer private keys. kms:Decrypt on the customer master key is granted only to the IAM principals the pass-issuing service runs as. Decryption happens on demand during pass signing, in process memory; plaintext material is never written to logs or durable storage.

Rotation

You can generate a new CSR at any time from the dashboard, sign it in your Apple Developer account, and upload the new .cer to replace the existing certificate. Coordinated rotations (for example, scheduled cutovers or suspected key compromise) are currently support-assisted. Email security@passmint.com and we'll help.

On account deletion

Encrypted key material and the corresponding KMS-wrapped DEKs are hard-deleted within 30 days of account closure. After that window the material is unrecoverable, including by Passmint.

Encryption

All customer data is encrypted at rest and in transit. Signing credentials receive an additional envelope-encryption layer above the storage-level encryption.

At rest: AES-256 at the storage layer for PlanetScale (database) and Cloudflare R2 (pass assets and certificate material). Encrypted database backups inherit the same encryption.
In transit: TLS 1.2 minimum; TLS 1.3 negotiated where supported. Modern AEAD cipher suites only (AES-GCM, ChaCha20-Poly1305). HSTS enabled on passmint.com and api.passmint.com.
Credentials: Envelope encryption: AES-256-GCM with per-secret DEKs wrapped by AWS KMS. See Credentials & certificates.
Webhook signing: HMAC-SHA256 over {timestamp}.{body} using a per-endpoint 192-bit secret. Verified with a 5-minute replay tolerance.
API key storage: Keys are hashed with SHA-256 before persistence. The plaintext key is shown once at creation and never stored.
Key management: A single AWS KMS customer master key in one US region wraps all per-secret DEKs. KMS decrypt permissions are restricted to the pass-issuing service's runtime IAM principals.

Infrastructure

Passmint runs on managed infrastructure from Cloudflare, AWS, and PlanetScale. We do not operate our own servers.

Web & API hosting: Cloudflare Workers. The platform is split into separate services that each hold only the credentials they need; the service able to decrypt customer signing keys has no public endpoint and is reachable only over internal service bindings, never from the internet.
Application database: PlanetScale (Postgres). TLS-only, no public ingress, fronted by Cloudflare Hyperdrive for connection pooling. Connections are authenticated with per-environment credentials.
Object storage: Cloudflare R2. Per-organization prefixes; access is granted by Worker binding rather than long-lived credentials, so no standing storage keys exist. The bucket holding encrypted certificate material is bound to the certificate service alone.
Key management: AWS KMS customer master key in a single US region.
DDoS & WAF: Cloudflare platform-level DDoS mitigation and WAF protect all customer-facing endpoints.
Secrets: Per-Worker secrets managed by Cloudflare; provider secrets (AWS, PlanetScale, Stripe, Resend) are issued per environment and rotated on departure of any engineer with access.

Access control (internal)

Passmint is a small team. We keep the surface area of production access correspondingly small.

All employee access to production systems (Cloudflare, AWS, PlanetScale, Stripe, Resend, email, source control) is behind SSO with MFA required.
Production database access is restricted to engineering staff with an operational need. Application code accesses the database through environment-scoped credentials, not through personal accounts.
Provider-native audit logs (Cloudflare, AWS CloudTrail, PlanetScale audit log) record console and API access to production resources. Retention follows each provider's native policy; exact windows are available on request.
Access is revoked on offboarding as part of a documented checklist; provider credentials tied to the departing engineer are rotated.

Application security

The Passmint API is a small, opinionated surface. These are the guarantees we make today, and the ones we explicitly do not yet make.

API authentication: Bearer API keys with mode prefixes: pmk_test_… and pmk_live_…. Test and live data are separated at the middleware layer. Keys are SHA-256-hashed at rest; the plaintext is returned once at creation. Keys are revocable and support expiry timestamps.
Scoped permissions: All keys today have full access within their organization. Scoped API tokens are on the roadmap; flag interest to us if this blocks you.
Webhook signatures: Every delivery is signed with HMAC-SHA256 and sent in a passmint-signature header of the form t=…,v1=…. We recommend verifying the signature and rejecting timestamps older than five minutes.
Delivery retries: Failed webhook deliveries are retried with exponential backoff over roughly 24 hours (up to 7 attempts) before being marked dead. Each attempt has a 10-second timeout.
Input validation: Pass fields are validated server-side against the template schema. Asset uploads are size-limited and content-type checked before being written to object storage.
Rate limiting: Platform-level rate limits and abuse protections are provided by Cloudflare today. Per-tenant application rate limits are on the roadmap.

Availability & reliability

Pass issuance is a real-time user-facing surface. A pass that fails to install is visible to your end user immediately, so availability is a first-class concern.

Status page: status.passmint.com
Uptime target: We do not currently offer a contractual uptime SLA. We target high availability, and incidents are posted to the status page. Enterprise customers can request SLA terms as part of a contract.
Backups: PlanetScale's managed backup and point-in-time restore applies to the primary application database. Encrypted credential material is backed up as part of the database. Retention: 30 days.
Restore testing: We have verified restore from backup and repeat the drill at least twice a year.
Incident communication: Incidents affecting customer data or availability are posted to the status page. For incidents that involve customer personal data, affected customers will be notified via the registered account-owner email within 72 hours of confirmation.

Compliance & attestations

We believe the honest version of this section is more useful than the aspirational one.

Passmint does not currently hold SOC 2, ISO 27001, or PCI attestations. We operate to a SOC 2–aligned control set internally and will pursue formal audit as customer demand justifies the investment. If a prospective customer's procurement process requires a specific attestation, tell us: that is the signal that moves this up the roadmap.

GDPR

Passmint acts as a data processor for the pass-holder data you submit and as a controller for your account data. A DPA is available on request at security@passmint.com. Our Privacy Policy describes how we process personal data. See the subprocessor list below; material changes will be announced here before they take effect.

Penetration testing

No external penetration test has been performed to date. We plan to commission one as customer demand justifies, and a summary will be available on request once completed.

Subprocessors

The third parties below process customer data on our behalf. Material additions will be announced on this page before they take effect.

Vendor	Purpose	Data processed	Region
Cloudflare	Web and API hosting, edge compute, object storage (R2), database connection pooling (Hyperdrive), DDoS/WAF	Customer request/response data, pass assets, encrypted certificate material	Global edge / US
PlanetScale	Primary application database	Account data, templates, passes, request and webhook logs	US
AWS	Key management (KMS)	KMS-wrapped data encryption keys	US
Stripe	Billing and payment processing	Customer billing contact; payment methods processed directly by Stripe and never stored by Passmint	US / Global
Resend	Transactional email delivery	Customer email addresses and email content	US
Sentry	Error monitoring and performance tracing	Internal resource identifiers (e.g. organization and pass IDs) captured with errors; no pass content, template data, or pass-holder data	US
Apple	Apple Wallet pass distribution	Pass payloads and push registrations required by the PassKit protocol	Global
Google	Google Wallet pass distribution	Pass payloads and issuance metadata required by Google Wallet	Global

Vulnerability disclosure

We welcome reports from security researchers. The fastest path to a fix is a clear report sent to the address below.

Contact: security@passmint.com
First response: Within 2 business days.
What to include: Clear reproduction steps, affected endpoints or artifacts, and the earliest time we can contact you for follow-up.
Bug bounty: No formal program today. We recognize significant reports case-by-case.

Safe harbor

Passmint will not pursue legal action against researchers who act in good faith, give us a reasonable window to remediate before public disclosure, avoid privacy violations and service disruption, and do not access or modify customer data beyond the minimum needed to demonstrate the issue.

Contact

The right address depends on what you're asking about.

Security questions: security@passmint.com
Privacy requests: privacy@passmint.com
Enterprise prospects: Email security@passmint.com to request the DPA, subprocessor list, and our responses to common security questionnaires.