> For the complete documentation index, see [llms.txt](https://docs.thewalletcrew.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.thewalletcrew.io/policies/privacy-and-security/security-overview-and-trust-model.md).

# Security overview and trust model

## Why this page exists

This overview supports legal, procurement, security, and pre-sales reviews. It explains how responsibilities, data handling, and security controls are divided across The Wallet Crew, client organizations, and wallet platforms.

**Last reviewed:** 13 July 2026.

## Shared responsibility and trust boundaries

The Wallet Crew operates the platform and applies its documented security and privacy practices. Client organizations decide which data to collect and remain responsible for their customer-facing legal obligations. Apple and Google operate their respective wallet ecosystems.

| Area                                     | Primary owner       | Notes                                                                                                                                                |
| ---------------------------------------- | ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
| Platform operation and tenant separation | The Wallet Crew     | Access rights are managed by organization. Server-side controls help restrict data to its owning organization.                                       |
| Data collection purpose and notices      | Client organization | The client defines the collection purpose, provides required information, and obtains consent where required.                                        |
| Wallet application and device services   | Apple / Google      | Apple and Google operate their wallet applications and related ecosystem services.                                                                   |
| Pass content and lifecycle               | Shared              | The client supplies approved content. The Wallet Crew processes pass distribution and updates. Wallet platforms display passes on supported devices. |
| Data subject requests                    | Shared              | The client leads requests. The Wallet Crew supports relevant access, modification, deletion, or objection requests through the platform.             |

### Responsibilities of The Wallet Crew

The Wallet Crew is responsible for operating, supporting, and maintaining the platform. This includes organization-level access controls, incident handling, and technical and organizational measures that protect confidentiality, integrity, and availability.

The Wallet Crew processes personal data only for contracted purposes and under the client’s documented instructions. Staff and external contractors are bound by confidentiality obligations.

### Responsibilities of the client organization

The client organization is responsible for the lawfulness of its data collection. This includes customer notices, consent where required, and the content of forms, passes, and communications.

The client also controls who receives access within its organization. It must provide accurate data and follow its own retention and deletion obligations.

### Responsibilities of Apple and Google

Apple and Google provide the wallet ecosystems used to store and display passes. Their services remain governed by their own terms, privacy notices, and security practices.

The Wallet Crew does not control the wallet platform, device operating system, or the end-user’s device settings.

## Data categories handled by the platform

Data processing depends on the client’s configuration and use case. The Wallet Crew supports data minimization by allowing clients to collect only the data needed for their stated purpose.

| Data category                                | Typical purpose                                                                | Sensitivity level |
| -------------------------------------------- | ------------------------------------------------------------------------------ | ----------------- |
| Operational data                             | Operate, support, and secure the platform.                                     | Moderate          |
| Pass metadata                                | Create, distribute, display, and update wallet passes.                         | Moderate          |
| User profile and contact data, if configured | Register customers, manage preferences, and connect records with a client CRM. | High              |
| Event, scan, and engagement data             | Measure pass interactions and support client engagement workflows.             | Moderate          |

The Wallet Crew does not process sensitive personal data by default. Client configurations may include names, email addresses, preferences, language settings, and loyalty information.

## Data flow overview

The following flow shows the main exchanges without describing implementation details.

### Simple flow diagram

```
Enrolment or form input
        ↓
The Wallet Crew platform processes the configured request
        ↓
Pass distribution or update
        ↓
Apple Wallet or Google Wallet displays the pass
        ↓
Configured notifications, scans, or engagement events
```

* **Enrolment and form input:** End-users submit information through client-configured forms, often accessed by QR code.
* **Platform processing:** The Wallet Crew processes the information for the contracted workflow. Client data can be transferred to the client’s systems or CRM tools.
* **Pass distribution and updates:** The platform creates or updates pass content for delivery to supported wallet applications.
* **Notifications and events:** Configured engagement activity can trigger pass updates or client workflows.

Apple and Google receive the information needed to make a pass available in their wallet ecosystems. The exact data exchanged depends on the pass configuration and the wallet platform’s requirements.

## Security controls overview

The Wallet Crew applies documented organizational and technical measures to protect platform data. The following summary supports initial due diligence. The [Security Insurance Plan](/policies/privacy-and-security/security-insurance-plan.md) provides the current detailed control description.

* **Encryption in transit:** Certificate lifecycle management is documented.
* **Encryption at rest:** Employee hard drives are encrypted.
* **Network and edge security:** All public traffic is routed through Cloudflare. Cloudflare provides WAF protection, TLS termination, global rate limiting, and CDN caching.
* **Origin protection:** Authenticated Origin Pulls use a custom private certificate. Traffic can reach Azure infrastructure only through Cloudflare. Direct origin access without Cloudflare-enforced rules is not possible.
* **Private network connectivity:** Internal Azure services communicate through Virtual Networks and Private Endpoints. Production and QA environments are not publicly accessible under normal conditions.
* **Transport security and infrastructure location:** All data in transit uses TLS 1.2 or higher. Azure infrastructure is hosted in European data centers.
* **Access controls:** Access is managed by organization and role. Back-office authentication uses Auth0 with OAuth 2.0 and PKCE. SSO is supported through Auth0-native identities and Okta. Administrator access uses named accounts and strong authentication. Generic privileged accounts are exceptional and traceable.
* **API and pass access:** API consumers authenticate with JWTs or API keys. Predictable pass identifiers are protected with HMAC-SHA256, shared secrets, or JWT authentication.
* **Tenant authorization:** Roles and permissions are enforced per tenant through custom JWT claims. Claims are evaluated on every request. Users can access only assigned resources and actions within their tenant context.
* **Logging and auditability:** Security events are logged, time-stamped, protected, and retained for one year. Authorized technical personnel access logs for authorized requests or proven incidents.
* **Audit and change tracking:** Auth0 audit logs record authentication events and configuration changes. Tenant configuration is versioned with a complete change history. This provides traceability for pass templates, connector settings, and operational rules.
* **Incident handling:** Security alerts are recorded, qualified, investigated, corrected, and reviewed for improvement. The [Data Protection FAQ](/policies/privacy-and-security/data-protection-faq.md) describes client notification for data breaches.

## Data residency and retention

The current policy states that The Wallet Crew uses Microsoft Azure for hosting and Cloudflare for security. All processing remains within EU boundaries. Azure infrastructure is hosted in European data centers.

At the end of the agreement, The Wallet Crew deletes or returns personal data unless European Union or Member State law requires retention.

## Procurement FAQ quick answers

<details>

<summary>Where does data live?</summary>

The current policy identifies Microsoft Azure as the hosting provider and states that processing remains within EU boundaries.

</details>

<details>

<summary>Who can access data?</summary>

Access is managed by organization and role. The Wallet Crew uses server-side controls to restrict data to its owning organization. Authorized technical personnel access security logs only for authorized requests or proven incidents.

</details>

<details>

<summary>What is shared with Apple and Google?</summary>

The wallet ecosystem receives information needed to provide the configured pass. The exact information depends on the pass configuration and platform requirements.

</details>

<details>

<summary>How are deletion requests handled?</summary>

The client leads data subject requests. The Wallet Crew supports relevant requests through the platform. At contract end, personal data is deleted or returned unless retention is legally required.

</details>

<details>

<summary>Which documents should be reviewed next?</summary>

Review the [Terms & Conditions](/policies/terms-and-conditions.md), [Data Processing Agreement model](/policies/privacy-and-security/data-processing-agreement-model.md), [Data Protection FAQ](/policies/privacy-and-security/data-protection-faq.md), and [Security Insurance Plan](/policies/privacy-and-security/security-insurance-plan.md).

</details>

## Related pages

* [Terms & Conditions](/policies/terms-and-conditions.md)
* [Data Processing Agreement model](/policies/privacy-and-security/data-processing-agreement-model.md)
* [Data Protection FAQ](/policies/privacy-and-security/data-protection-faq.md)
* [Security Insurance Plan](/policies/privacy-and-security/security-insurance-plan.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.thewalletcrew.io/policies/privacy-and-security/security-overview-and-trust-model.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.