Pass Studio issues Apple Wallet and Google Wallet passes on behalf of merchants. This page describes where your data lives, how it is protected, and what happens to it over time. It is written for the person evaluating us, not for lawyers. The binding terms are in the Data Processing Addendum and Privacy Policy.
Hosting and infrastructure
- Provider. Pass Studio runs on Google Cloud Platform in the
us-central1region (Iowa, United States). - Compute. The application runs on Cloud Run, a managed, containerized runtime. There are no long-lived servers to patch; every deploy is a fresh image.
- Data stores. Cloud Firestore for application data, Cloud Storage for pass assets and generated pass files, BigQuery for analytics events.
- Isolation. All merchant data is scoped by account and team identifiers at the application layer. Every read and write is checked against the caller's account or team; there is no shared, tenant-less path.
- Backups. Firestore and Cloud Storage are replicated by Google within the region. We do not operate separate backup infrastructure.
Encryption
- In transit. All connections use TLS. Plain HTTP is redirected. This applies to the dashboard, the public API, wallet update traffic to Apple and Google, and every inbound webhook.
- At rest. All data stores and their backups are encrypted at rest using Google Cloud default encryption (AES-256). We do not currently offer customer-managed encryption keys.
Secrets and credentials
- Wallet signing. Apple pass signing certificates are stored in Google Secret Manager and read by the signing service at runtime. They are never written to the application database, logs, or container images.
- API keys. Your API keys are stored as SHA-256 hashes. The plaintext key is shown once at creation and cannot be retrieved afterwards. Keys can be revoked at any time from Settings.
- Integration secrets. Shopify and Square credentials are held per merchant connection. Your webhook signing secret is used only to verify webhooks addressed to you; it is never shared with, or used for, another merchant. Disconnecting an integration removes its credentials.
- Inbound webhooks. Every inbound webhook is verified against the sender's signature before the body is processed. Requests that fail verification are rejected without side effects, and sources sending malformed traffic are blocked.
Access control
- Who can see your data. Your data is accessible to your account and the team members you invite. Team roles limit what each member can do.
- Staff access. Pass Studio staff access customer data only to operate the service, investigate a support request you have raised, or as required by law. Access to production is limited to named individuals through Google Cloud IAM and recorded in Cloud Audit Logs.
- Authentication. Dashboard sign-in is handled by Firebase Authentication. Passwords are never stored or seen by Pass Studio. Password resets use one-time links.
Privacy and compliance
- Roles. For pass holder data, the merchant is the data controller and Pass Studio is the processor. Our DPA is part of the Terms and applies automatically; a countersigned copy is available on request.
- International transfers. Data is stored in the United States. Transfers from the UK and EEA are covered by the European Commission's Standard Contractual Clauses, incorporated in the DPA.
- Sub-processors. Google Cloud Platform / Firebase (hosting, storage, authentication, analytics), Resend (transactional email for pass installation links), Stripe (merchant billing only; never receives pass holder data). We give notice before adding a sub-processor.
- GDPR and platform requests. Data subject requests (access, correction, export, deletion) are handled within 30 days. Deletion requests that arrive through platform integrations, such as Shopify's customer and shop redaction webhooks, are recorded and executed automatically on the platform's schedule, without manual handling.
- Wallet providers. Passes are delivered through Apple Wallet and Google Wallet under their respective developer programs. Pass content you configure is sent to those services so the pass can be rendered and updated on the holder's device.
Data retention
| Data | Retained |
|---|---|
| Account and pass content | For the life of the account; deleted or anonymized within 30 days of account deletion |
| Individual analytics events (with IP-derived location or user agent) | Up to 13 months, then deleted or aggregated |
| Aggregated, non-identifiable statistics | Indefinitely |
| Data received from a connected platform (e.g. Shopify) | While the integration is active; deleted within 30 days of disconnection, account deletion, or a platform deletion request |
| Billing and transaction records | As required by law, up to 7 years |
| API request error logs | 30 days, in Google Cloud Logging; request bodies are never copied to the analytics warehouse |
| Support communications | 24 months from last contact |
Availability and monitoring
- Scheduled jobs (wallet updates, integration syncs, data retention sweeps) are monitored, and a failed run alerts us.
- We do not publish a contractual uptime SLA at this time.
Reporting a security issue
If you believe you have found a vulnerability, email support@thepassstudio.com with the details. We will not take action against good-faith research that avoids accessing other customers' data.
Questions
For security questionnaires, a countersigned DPA, or anything not covered here, contact support@thepassstudio.com.