What we hold, and what we never see

Card data

Payment takes place on Stripe Checkout, on Stripe's domain. Card numbers, expiry dates and security codes are entered into Stripe's form and sent to Stripe. They are never transmitted to, stored by, or passed through Passback. PCI DSS scope rests with Stripe.

Your Stripe account

You connect through Stripe Connect. Passback stores the connected account id and nothing else: no secret key, no restricted key, and no token that can act on your account beyond creating Checkout sessions and reading the subscriptions they produce. Charges are direct charges on your account. Disconnecting in your Stripe dashboard revokes access immediately.

Your customers

For each subscriber Passback stores the email address provided to Stripe, the Stripe customer and subscription ids, the plan, the status, and a device id if your app supplied one. Names, addresses and payment details are not stored. Answers given in your funnel are stored against an anonymous visitor id.

Database

Postgres on Supabase, with row-level security on every table a developer can reach. Policies are expressed in terms of the authenticated user, so a dashboard query cannot read another account's funnels, subscribers or events: the database enforces the boundary, not the application. The service role is used only where there is no user session — webhooks, the public funnel, and the entitlement API.

Credentials and tokens

• No secret is compiled into the browser bundle. There is no Supabase client and no Stripe key in the front end; every query runs on the server.
• Sessions are httpOnly, SameSite cookies carrying Supabase's own tokens.
• Return tokens and attribution credentials are encrypted with AES-256-GCM under a key held only in the server environment.
• API keys for the entitlement endpoint are stored as hashes. The plaintext is shown once, at creation.
• Stripe webhooks are verified against the signing secret before any write. Unverified events are rejected and logged.

Infrastructure

The application runs on Vercel, the database on Supabase, payments on Stripe, and transactional email on Resend. All traffic is encrypted in transit. There is a single production environment.

Certifications

Passback does not currently hold SOC 2, ISO 27001 or an independent penetration test report. If your procurement process requires one, please contact us before subscribing.

Reporting a vulnerability

Write to us through the contact page with “security” in the subject. We acknowledge reports within two working days, fix confirmed issues before any public disclosure, and credit reporters who wish to be credited. Please do not test against other customers' funnels or data.

Updated 13 September 2026. See also the data processing terms and privacy policy.