Security

How we protect your data

Passports and personal documents are sensitive. This page explains, in plain words, how they are stored, who can open them, and how to report a problem.

See the measures Report a problem

What protects your documents

Measures that are switched on today, described plainly.

Files stay on our serversPassports, photos and issued visas are stored in Evisa's own Postgres database, next to your application. No outside file-sharing service.
Every staff view is loggedEach time a staff member opens one of your files, who and when is recorded.
Access by roleStaff accounts have roles. Each role sees only the tools and data it needs.
One-time email codesNo password to leak. You sign in with a code sent to your email, and repeated requests and guesses are limited.
Uploads checked by contentEach upload is checked by its real bytes, not its name. Only JPG, PNG, WebP or PDF under 10 MB is accepted.
Cards stay with the providerCard details are typed on the payment provider's page. This site never sees or stores the full card number.
HTTPS and browser guardsPages are served over HTTPS only and cannot be embedded in other sites, which blocks common tricks like clickjacking.
Kept only as long as neededPassport files are kept to finish the application and meet record-keeping duties, then deleted or anonymised.

1. Where your files live

Uploaded passports, photos and issued visas are stored on Evisa's own servers, in the same database as your application. They are not copied to an outside file-sharing or storage service.

2. Who can open them

Only you and the staff working on applications can open a file. Every time a staff member opens one, the access is logged. Each staff role sees only what it needs.

3. Signing in

There are no passwords to leak. You sign in with a one-time code sent to your email, and repeated attempts are limited to stop guessing.

4. Checking uploads

Every upload is checked by its real content, not just its name, and must be a JPG, PNG, WebP or PDF under 10 MB. Anything else is refused.

5. Payments

Card details are entered on the payment provider's page. This site never sees or stores your full card number.

6. Retention

Passport files are kept only as long as needed to finish the application and meet record-keeping duties, then deleted or anonymised.

7. Report a problem

If you think you found a security issue, email the support address on the contact page with the details. Please do not test with other people's data. We reply to every report.

Responsible disclosure

Found a security issue?

Tell us privately first and give us time to fix it before sharing it anywhere. We reply to every report.

Email support@evisa.tv

Please include

The page or address affected
Steps to reproduce it
What an attacker could do

Please do not

Open or change other people's data
Slow down or overload the site
Publish before it is fixed

A question about your own account or files? Use the contact page