Privacy & Data Protection
Pass operates globally and complies with regional data protection regulations. Our architecture is built on a fundamental cryptographic principle: We cannot view, decrypt, or sell your credentials.
Regional Compliance Documents
Please select your operational region to review the specific legal framework governing your tenant workspace.
United Kingdom
Full compliance with UK GDPR, the Data Protection Act 2018 (DPA), and PECR standards.
European Union
Strict alignment with the EU General Data Protection Regulation (GDPR) and cross-border transfer rules.
United States
Covers California Consumer Privacy Act (CCPA), CPRA, and state-level consumer privacy statutes.
India
Compliant with the Digital Personal Data Protection (DPDP) Act 2023 and CERT-In compliance norms.
Zero-Knowledge Architecture
Credentials encapsulated in Pass vaults are encrypted client-side using keys only you and your authorized administrators possess.
Ephemeral DOM Processing
Authentication variables are purged from browser memory within 5 seconds. Pass does not log or persist plaintext passwords anywhere.
No Data Selling or Telemetry
Pass never sells user data, session metrics, or customer activity logs to third parties, ad networks, or data aggregators.
Enterprise Compliance & DPA Requests
Need a custom Data Processing Agreement (DPA), standard contractual clauses (SCCs), or SOC-2 compliance attestation? Contact the Pass Legal & Compliance Team: