Compliance

PassCryp is GDPR-ready: lawful basis for processing is contract performance (delivering the service you signed up for), data minimization is enforced by zero-knowledge architecture (we cannot collect data we cannot decrypt), and data subject rights (access, rectification, erasure, portability) are implemented in the product.

EU customers on Pro get EU data residency: vault ciphertext is stored in EU regions only, with Standard Contractual Clauses for any cross-border processing (e.g., support tickets routed to a US time zone). The DPA available with Premium and Pro covers Article 28 processor obligations in standard language.

California (CCPA, CPRA): full data access, deletion, do-not-sell, and limit-use-of-sensitive-data rights implemented in account settings.

Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA): equivalent rights honored under the same controls. We treat the strictest applicable law as the baseline for all US customers.

Children's privacy: PassCryp is not intended for users under 13. We do not knowingly collect data from children under 13; accounts identified as such are terminated and data deleted.

HIPAA: BAAs available on Pro on a case-by-case basis after a security review. Not appropriate for primary PHI storage; appropriate for credentials that grant access to HIPAA-regulated systems.

FedRAMP: not on the roadmap. FedRAMP is a multi-year, multi-million-dollar undertaking that doesn't fit a sub-50-seat tool.

ISO 27001: not on the immediate roadmap. Our SOC2 Type II work overlaps significantly; we may pursue ISO 27001 after SOC2 ships.