Security overview and trust model
A decision-maker overview of responsibilities, data handling, and security controls.
Why this page exists
This overview supports legal, procurement, security, and pre-sales reviews. It explains how responsibilities, data handling, and security controls are divided across The Wallet Crew, client organizations, and wallet platforms.
Last reviewed: 13 July 2026.
Shared responsibility and trust boundaries
The Wallet Crew operates the platform and applies its documented security and privacy practices. Client organizations decide which data to collect and remain responsible for their customer-facing legal obligations. Apple and Google operate their respective wallet ecosystems.
Platform operation and tenant separation
The Wallet Crew
Access rights are managed by organization. Server-side controls help restrict data to its owning organization.
Data collection purpose and notices
Client organization
The client defines the collection purpose, provides required information, and obtains consent where required.
Wallet application and device services
Apple / Google
Apple and Google operate their wallet applications and related ecosystem services.
Pass content and lifecycle
Shared
The client supplies approved content. The Wallet Crew processes pass distribution and updates. Wallet platforms display passes on supported devices.
Data subject requests
Shared
The client leads requests. The Wallet Crew supports relevant access, modification, deletion, or objection requests through the platform.
Responsibilities of The Wallet Crew
The Wallet Crew is responsible for operating, supporting, and maintaining the platform. This includes organization-level access controls, incident handling, and technical and organizational measures that protect confidentiality, integrity, and availability.
The Wallet Crew processes personal data only for contracted purposes and under the client’s documented instructions. Staff and external contractors are bound by confidentiality obligations.
Responsibilities of the client organization
The client organization is responsible for the lawfulness of its data collection. This includes customer notices, consent where required, and the content of forms, passes, and communications.
The client also controls who receives access within its organization. It must provide accurate data and follow its own retention and deletion obligations.
Responsibilities of Apple and Google
Apple and Google provide the wallet ecosystems used to store and display passes. Their services remain governed by their own terms, privacy notices, and security practices.
The Wallet Crew does not control the wallet platform, device operating system, or the end-user’s device settings.
Data categories handled by the platform
Data processing depends on the client’s configuration and use case. The Wallet Crew supports data minimization by allowing clients to collect only the data needed for their stated purpose.
Operational data
Operate, support, and secure the platform.
Moderate
Pass metadata
Create, distribute, display, and update wallet passes.
Moderate
User profile and contact data, if configured
Register customers, manage preferences, and connect records with a client CRM.
High
Event, scan, and engagement data
Measure pass interactions and support client engagement workflows.
Moderate
The Wallet Crew does not process sensitive personal data by default. Client configurations may include names, email addresses, preferences, language settings, and loyalty information.
Data flow overview
The following flow shows the main exchanges without describing implementation details.
Simple flow diagram
Enrolment and form input: End-users submit information through client-configured forms, often accessed by QR code.
Platform processing: The Wallet Crew processes the information for the contracted workflow. Client data can be transferred to the client’s systems or CRM tools.
Pass distribution and updates: The platform creates or updates pass content for delivery to supported wallet applications.
Notifications and events: Configured engagement activity can trigger pass updates or client workflows.
Apple and Google receive the information needed to make a pass available in their wallet ecosystems. The exact data exchanged depends on the pass configuration and the wallet platform’s requirements.
Security controls overview
The Wallet Crew applies documented organizational and technical measures to protect platform data. The following summary supports initial due diligence. The Security Insurance Plan provides the current detailed control description.
Encryption in transit: Certificate lifecycle management is documented.
Encryption at rest: Employee hard drives are encrypted.
Network and edge security: All public traffic is routed through Cloudflare. Cloudflare provides WAF protection, TLS termination, global rate limiting, and CDN caching.
Origin protection: Authenticated Origin Pulls use a custom private certificate. Traffic can reach Azure infrastructure only through Cloudflare. Direct origin access without Cloudflare-enforced rules is not possible.
Private network connectivity: Internal Azure services communicate through Virtual Networks and Private Endpoints. Production and QA environments are not publicly accessible under normal conditions.
Transport security and infrastructure location: All data in transit uses TLS 1.2 or higher. Azure infrastructure is hosted in European data centers.
Access controls: Access is managed by organization and role. Back-office authentication uses Auth0 with OAuth 2.0 and PKCE. SSO is supported through Auth0-native identities and Okta. Administrator access uses named accounts and strong authentication. Generic privileged accounts are exceptional and traceable.
API and pass access: API consumers authenticate with JWTs or API keys. Predictable pass identifiers are protected with HMAC-SHA256, shared secrets, or JWT authentication.
Tenant authorization: Roles and permissions are enforced per tenant through custom JWT claims. Claims are evaluated on every request. Users can access only assigned resources and actions within their tenant context.
Logging and auditability: Security events are logged, time-stamped, protected, and retained for one year. Authorized technical personnel access logs for authorized requests or proven incidents.
Audit and change tracking: Auth0 audit logs record authentication events and configuration changes. Tenant configuration is versioned with a complete change history. This provides traceability for pass templates, connector settings, and operational rules.
Incident handling: Security alerts are recorded, qualified, investigated, corrected, and reviewed for improvement. The Data Protection FAQ describes client notification for data breaches.
Data residency and retention
The current policy states that The Wallet Crew uses Microsoft Azure for hosting and Cloudflare for security. All processing remains within EU boundaries. Azure infrastructure is hosted in European data centers.
At the end of the agreement, The Wallet Crew deletes or returns personal data unless European Union or Member State law requires retention.
Procurement FAQ quick answers
Where does data live?
The current policy identifies Microsoft Azure as the hosting provider and states that processing remains within EU boundaries.
Who can access data?
Access is managed by organization and role. The Wallet Crew uses server-side controls to restrict data to its owning organization. Authorized technical personnel access security logs only for authorized requests or proven incidents.
What is shared with Apple and Google?
The wallet ecosystem receives information needed to provide the configured pass. The exact information depends on the pass configuration and platform requirements.
How are deletion requests handled?
The client leads data subject requests. The Wallet Crew supports relevant requests through the platform. At contract end, personal data is deleted or returned unless retention is legally required.
Related pages
Last updated