Security Questionnaire
Last updated: 1 September 2026
Pre-filled answers to the questions vendor security reviews ask most often. If your process needs these in a specific portal or format, send the questionnaire to [email protected] and we will complete it.
Company
Legal entity and registration. Proof of Stake SRL, registered in Romania. Trade Registry No. J35/638/2018, sole registration code / VAT RO38943299.
What does the service do? A REST API and dashboard that generate, host, update, and revoke Apple Wallet and Google Wallet passes on behalf of business customers.
Where are the terms, privacy policy, and DPA? /terms/, /privacy/, and /trust/dpa/. The DPA is signable per its execution section.
Hosting and data residency
Where is the service hosted? Entirely on Cloudflare’s managed platform (Workers, D1, R2, Queues). We operate no servers of our own.
Where is customer data stored? At rest in Cloudflare’s European Union region: the primary database and the pass object store both run in Cloudflare’s EU location, with no replicas outside it.
Is processing EU-only? No. Request processing runs on Cloudflare’s global edge network. Traffic is encrypted in transit, and the transfers involved are covered by Cloudflare’s EU Standard Contractual Clauses and its EU Cloud Code of Conduct verification.
Is EU residency contractually guaranteed? The EU storage location is our operational configuration, not a contractually pinned jurisdiction. A contractual residency commitment can be discussed separately.
Encryption
In transit? TLS on all API, dashboard, and website traffic, and on connections to Apple and Google.
At rest? Yes, platform-wide by Cloudflare. Customer-supplied signing credentials are additionally encrypted at the application layer with AES-256-GCM, with each ciphertext bound to the owning account.
Access control
Who can access production? Authorised personnel of Proof of Stake SRL only. Operational tooling uses scoped, least-privilege API tokens.
How do customers authenticate? API requests use per-account 128-bit random bearer keys, rotatable on request. Dashboard sign-in is passwordless: one-time email codes or Google sign-in. We store no passwords.
Is customer data segregated? Logically, per account: every record and stored object is keyed to the owning account and authorisation checks run on every request.
Application and operations
How does code reach production? Deploys are manual and deliberate, from the reviewed main branch, with preflight checks; nothing auto-deploys on push. Database migrations are reviewed and applied separately from code deploys.
Do you log and monitor? Yes. Platform invocation logs and metrics, plus an independent scheduled health-check worker that monitors the API.
Rate limiting and abuse controls? Unauthenticated endpoints are rate limited per IP at the edge; authenticated usage is metered per plan.
Data lifecycle
What personal data do you process? As controller: customer email, billing identifiers, usage and technical data. As processor: pass content customers submit and End-User device data (push tokens, install state). Special-category data, card numbers, and government ID numbers are contractually prohibited from passes.
Retention and deletion? Account deletion within 30 days of request. Apple Wallet error logs at most 7 days. Verification codes expire within minutes. Full detail in Section 7 of the Privacy Policy.
Can customers export their data? Yes. Passes export as JSON through the pass export, and we fulfil full-account export requests to [email protected], consistent with the EU Data Act switching provisions in Section 15 of the Terms.
Incident response and continuity
Breach notification? We notify affected customers without undue delay, and in any event within 72 hours of becoming aware, per the DPA.
Backups and recovery? The primary database supports point-in-time recovery covering the previous 30 days. Signed pass files are rebuilt automatically from stored canonical pass bodies.
Uptime commitment? No general SLA; Business plans include a committed SLA.
Compliance
SOC 2 or ISO 27001? No.
Third-party penetration test? Not commissioned to date. Vulnerability reports are welcome at [email protected].
Sub-processors? Listed with roles, locations, and transfer mechanisms at /trust/subprocessors/, with a dated changelog and 30 days’ advance notice of changes.
GDPR roles? Controller for customer account, billing, and analytics data; processor for pass content and End-User device data, under the Article 28 terms in the Terms and the standalone DPA.