A check should return the fact it needs, not a copy of the document behind it. Our products are built that way, but each one keeps different data, and a security review needs the details. This page sets them out per product.
What each product keeps
VisitorPass
VisitorPass runs as a service that Partisia operates. It keeps what a visit needs:
- the host’s name and e-mail address;
- the guest’s e-mail address and the name they enter, plus their company, phone number and license plate where the visit template asks for them;
- the name and date of birth shared from AltID, where the visit template asks for an AltID check;
- the visit’s title and booked time, and when the guest checked in and out.
The credential in the guest’s wallet carries only their e-mail address and is valid for one year. Each customer has its own keys for issuing and checking credentials, which Partisia holds on the customer’s behalf. Application logs are kept for 180 days.
AgeVerify
Your service receives one answer: whether the person is over the age limit you ask about. The request asks the wallet for that attribute alone, so no name, date of birth, CPR number or ID document is part of the response.
Credential APIs
The issuer and the verifier ship as Docker images that you run on your own infrastructure, and credentials are signed with your own key. They keep metadata about the requests they handle, not the personal data inside a credential.
SitePass
Ask us for the data description that applies to your site.
Partisia ID Wallet
The wallet creates its private key in the phone’s secure element, and the key never leaves the phone: Partisia has no access to it. Credentials and their history are stored on the phone, not in the cloud, and deleting the app deletes them. The Partisia ID Wallet privacy policy has the full description.
Where it runs
What Partisia runs for you runs on servers that Partisia operates at Hetzner in Germany, with daily backups held in Denmark and Germany. That covers VisitorPass and SitePass, and AgeVerify and the Credential APIs when you use them as a service. Staff sign in through single sign-on, and administrators also use multi-factor authentication. A product you deploy yourself runs on your own infrastructure.
Sub-processors
VisitorPass uses these sub-processors:
| Sub-processor | What for |
|---|---|
| Hetzner Online GmbH | Hosting the service and its database |
| Delivering the service’s e-mail, and the mailbox that receives invitations |
Identity checks with AltID run through the AltID service of the Danish Agency for Digital Government. The processors behind this website are listed in our privacy policy.
Certifications
Partisia does not hold ISO 27001 or SOC 2 certification today. When that changes, the certification and its scope will be listed here. The standards our credentials follow are listed on the Credential APIs page.
Reporting a vulnerability
Use the contact form and say it is a security report, or call +45 53 87 51 11, and it will reach the right people. Please give us a reasonable window to fix an issue before you disclose it publicly. Our machine-readable policy is at /.well-known/security.txt, in line with RFC 9116.
For procurement teams
- Legal entity: Partisia Applications ApS, CVR 39454882, Aabogade 15, 8200 Aarhus N, Denmark.
- EU funding: backed by the EIC Accelerator under Horizon Europe, Grant Agreement No. 101297763. See EU funding.
- Accessibility: our accessibility statement sets out the target this website is built and tested to.
- References: we name customers only where they have agreed to it. Ask us, and we will tell you what we can.