Passport-grade care for family records.
Heritage Passport handles lineage facts, identity documents, addresses, and payment events. The security posture is deliberately plain: limit access, protect uploads, avoid reselling sensitive data, and state the current safeguards without inventing certifications.
Documents stay tied to their owner and case.
PassVault uploads use short-lived signed upload URLs, permitted file types, size limits, and storage paths bound to the signed-in user, case, and document.
- Upload signing and finalization require an authenticated user.
- Server-side checks confirm case ownership and the expected storage path.
- Supported image and PDF types are enforced before processing.
- Family sharing can expose status without exposing private document images.
Established providers handle specialized systems.
Supabase provides authentication, Postgres, and object storage. Stripe handles card collection and payment processing, so Heritage Passport does not store raw card numbers.
- Encryption in transit and at rest on provider infrastructure.
- Owner-scoped database policies and service checks.
- Stripe-hosted card handling and signed webhook verification.
- Bot and abuse checks on configured public account-entry flows.
A security page should not claim a report that does not exist.
Heritage Passport does not claim SOC 2, HIPAA, ISO 27001, zero-knowledge encryption, end-to-end encryption, or a formal penetration-testing program unless supporting evidence exists.
- No invented certification marks.
- No claim that document extraction authenticates a record.
- No claim that account access eliminates all risk.
- No sale of sensitive identity data for cross-context behavioral advertising.
The policies control retention, deletion, and account rights.
This page summarizes the current implementation in plain English. The Privacy Policy and Terms of Service control collection, sharing, retention, deletion, and account rights.
Begin with the facts in your family.
The free eligibility check shows which country path is worth pursuing before you organize the case around it.