Security & SLA

The platform runs on enterprise-grade cloud providers with redundant instances, logical tenant isolation and separation between development, staging and production.

Pass signing certificates and keys are stored encrypted and used only by authorised services at issuance time.

Automated daily backups with periodic restore testing.

Data in transit: TLS 1.2 or higher on all public connections, with HSTS enabled.

Data at rest: AES-256 encryption managed by the infrastructure provider.

Passwords stored with modern key derivation functions; secrets and API keys kept in a managed vault, never in source code.

Internal administrative access is least-privilege, with mandatory multi-factor authentication and periodic permission reviews.

Audit logs for sensitive actions, including pass issuance, update and voiding.

Staff and contractors sign confidentiality undertakings; access is revoked within 24 hours of offboarding.

Code review, version control and automated pipelines with vulnerable dependency scanning.

Production customer data is not used for testing, except in anonymised form.

Periodic security assessments with remediation prioritised by severity.

Monthly availability target for the issuance API and dashboard: 99.5% on standard plans and 99.9% on Enterprise plans with a specific SLA.

Calculation is based on minutes of total service unavailability in the calendar month, as measured by PassFlow monitoring.

Excluded: scheduled maintenance windows announced at least 48 hours in advance; third-party failures outside PassFlow's control, including Apple, Google, carriers, ISPs and Customer integrations; use contrary to the documentation; and force majeure events.

Planned maintenance is preferably performed in low-usage windows and announced by email and/or in the dashboard.

Emergency security maintenance may occur without prior notice, with communication afterwards.

Official support channel: contact@passflow.lat, business days, 9am to 6pm (Brasília time).

Severity 1 (production service unavailable): first response within 4 business hours.

Severity 2 (critical functionality degraded): first response within 8 business hours.

Severity 3 (questions, general requests): first response within 2 business days.

These targets refer to the first qualified response, not to final resolution, which depends on complexity and third-party dependencies.

If the availability target is missed in a calendar month, the Customer may request a credit of 5% of the monthly fee per percentage point below target, capped at 20% of that month's fee.

Requests must be submitted in writing within 30 days of the end of the affected month. A credit on a future invoice is the sole and exclusive remedy for missing the availability target.

Incident response plan covering classification, containment, eradication, recovery and post-incident review.

Affected customers are notified without undue delay, as set out in the Data Processing Agreement.

Internal recovery objectives: RPO of 24 hours and RTO of 8 hours for production infrastructure failures.

Protect credentials, API keys and certificates; enable multi-factor authentication where available.

Keep technical contact details up to date and review team permissions.

Report vulnerabilities to contact@passflow.lat. We ask for responsible disclosure and no testing that degrades the service or exposes third-party data.