Security and reliability

Infrastructure

Passin runs on Cloudflare's global network (Workers and D1). All traffic is HTTPS only; pages ship a strict Content-Security-Policy and cannot be framed.

Credentials and secrets

• Passwords are stored as salted, peppered, multi-round PBKDF2-SHA256 hashes and checked against known-breach lists on sign-up.
• API keys are stored only as hashes and shown once at creation; they can be rotated at any time.
• Payment-provider credentials and OAuth secrets are encrypted at rest (AES-GCM) and never returned by any API.
• Card data never touches our systems: buyers pay on the provider's hosted page (for example Stripe Checkout), so the card-data scope stays with the provider.

Abuse protection

Rate limits per IP, per email and per app; progressive bot checks and temporary locks on repeated failed sign-ins; an audit log of every sign-in and account change.

Webhooks

Every webhook is signed with HMAC-SHA256 and a timestamp (replay window 5 minutes), queued before delivery and retried with back-off, so a short outage on your side loses nothing.

Availability

We target 99.9% monthly availability for the Authentication and Payments APIs. There is no contractual SLA yet; planned maintenance and incidents are announced by email to account contacts.

Reporting a vulnerability

Email contact@passin.io with "security" in the subject. We acknowledge within two business days and do not pursue good-faith research.