Security

Passim is built to be used inside a law practice. This page states the controls that protect research done through it, in specific terms. Passim is not yet independently audited; where a control is planned rather than in place, this page says so.

At a glance

What Passim receives, and what it doesn’t

Passim is a retrieval service. Your AI assistant sends it a research query over MCP and gets back legal sources, citations, and research signals. Passim receives the information included in those tool calls. It does not automatically receive the rest of your conversation or your files; avoid including client identifiers or confidential facts in research queries. The assistant is a separate system under its own agreement: it decides when to call Passim, keeps its own copy of the results under your workspace’s settings, and is not a Passim subprocessor. Passim cannot configure its retention, training, or administrator controls, and does not claim to.

No training on customer data

Passim does not use account data, queries, tool calls, or support messages to train or fine-tune any model, and does not send your queries to any AI provider. AI is used on public legal materials only, to summarize and classify them.

Queries are processed, not stored

The text of a research query is processed to answer it and is excluded from application logs and usage records. Usage records keep the calling identity, tool name, date, counts, timing, and error or rate-limit totals. Research requests carry queries in request bodies rather than URLs. Error monitoring is configured not to capture request bodies; content fields are fingerprinted when operational correlation is needed. Our operational-log retention target is no more than 90 days, subject to documented security, abuse, dispute, and legal holds. Provider-native logs and retained security aggregates have separate retention settings. Retention checks and collection coverage are reviewed as operating controls.

Encryption and network

Traffic to the website, the API, and the MCP server is encrypted with TLS. Render’s hosting runs behind Cloudflare, which terminates TLS for that traffic before it reaches Render. Managed production databases use authenticated connections and restricted network access. Application traffic can use private networking; approved operational systems also connect through external endpoints restricted by IP allowlists and credentials. Application services and scheduled jobs use separate database roles. Secrets are held in platform and protected operational secret stores.

Access control

Users sign in with individual identities through OAuth. The shared production MCP bearer has been retired. Issued API keys are stored as hashes and can be scoped, given an expiry, and revoked individually. Administrator access requires multi-factor authentication. Provider access reviews are required at least quarterly, with incomplete reviews tracked for follow-up. Cookie-authenticated browser changes are protected by same-origin checks.

Backups and recovery

The primary and national production databases have seven-day point-in-time recovery configured. High availability is not currently enabled. Passim also maintains daily independent backups of the primary database and monthly full restore checks. The October 1, 2026 primary-database restore completed successfully. A full restore test of the separate national database and an end-to-end service recovery exercise remain to be completed; a configured recovery window is not a guarantee of recovery time.

Secure development

Production changes follow a guarded review and release process with automated tests, dependency checks, static analysis, and secret scanning. Production dependencies are installed from the reviewed lockfile. Reviewed findings are tracked against regression baselines. Our remediation targets are 7 days for critical findings, 14 for high, 30 for medium, and 90 for low; exceptions and overdue work require review.

Monitoring and incident response

Privacy-minimized security evidence is collected on a daily schedule and retained for 90 days, with limits on its contents and size. Collection coverage and missed runs are reviewed; this is not a claim of uninterrupted historical coverage. Incidents are triaged by severity, contained, investigated, and documented. If an incident affects you, we notify you without unreasonable delay, with a target of 72 hours from confirmation.

People

Passim is operated by its founder, a practicing immigration attorney. Human administrative access and machine identities have distinct roles. Authorized automation uses scoped credentials for defined operations. Administrative MFA, provider access, and recovery arrangements are reviewed as part of the security program.

Vendors

The subprocessors page describes providers that process customer data for Passim. Provider diligence covers access, data handling, contractual terms, and available assurance reports. Completion of the current vendor review and collection of restricted assurance documents are part of the readiness work in progress.

Domain and email

The passimai.com domain is protected by DNSSEC. Its current DMARC policy is monitoring-only (p=none), so it does not instruct receivers to reject unauthenticated messages. Google Workspace mail has an SPF record. Stronger DMARC enforcement requires validation of all legitimate sending services before activation.

Independent assurance

Passim has not received a SOC 2 report. Its controls and evidence are being prepared for an independent assessment; the report scope and timing have not been finalized. Independent penetration testing is planned and has not yet been completed. Until that work is complete, the controls described here are Passim’s own statements and are available for review in security questionnaires.

Reporting

To report a vulnerability, email chris@passimai.com with “Passim security report” in the subject line, and please do not post exploit details publicly. To ask for review of a public record in the library, send the source URL, the document identifier, and the concern to the same address.