| Control | Meaning | Status |
|---|---|---|
| Rights documentation | A recorded basis for permitted use. | In progress |
| Local file verification | File hashing stays in your browser. | In place |
| Independent passport verification | Public keys and signed manifests. | In place |
| Human privacy review | A specialist reviews each proposed dataset. | Planned |
| In-region evaluation | An isolated environment before delivery. | Planned |
| Hardware-backed signing | Keys protected by a dedicated key service. | Planned |
| Organization approvals | Organizations start pending. An administrator reviews access. | In place |
| Document access | Private, organization-scoped documents. PDF and DOCX only. | In place |
| Abuse prevention | Honeypot and server-side submission limits. | In place |
| Turnstile challenge | External bot challenge configuration. | Planned |
| Independent transparency witnesses | External monitoring of published passport history. | Planned |
Launch-stage risk policy
We begin with data that has a clear path to permitted use. Health, biometric, children’s and financial-account data are excluded. Uncertain personal-data rights require a human review. Contractual restrictions require written permission before resale.
The supplier checker is provisional. It explains its reasoning, but is not a legal decision and does not authorize the sale of data.
Designed with the region in mind.
Our process is designed with UAE PDPL, DIFC and ADGM requirements in mind. We do not claim a certification or legal compliance that has not been established. Transaction-specific legal review remains necessary.
How revocation works
Administrators must supply a reason. The public registry retains the passport and marks its status, reason and revocation date. Verification checks current status, not just the signature.
Responsible disclosure
Report a potential issue through our contact form. Please describe the issue without including raw customer data, credentials or sensitive records.