abizon

Security

You are handing us your passport

That deserves more than a trust badge. Here is exactly what happens to your documents, who can see them, how long we keep them, and how to report it if we've got something wrong.

Controls

How your data is protected

  • Encrypted in transit and at rest

    TLS 1.3 everywhere, AES-256 at rest. Document blobs sit in a separate store from application metadata, with distinct key material for each.

  • Documents deleted after filing

    Passport and photo scans are destroyed 30 days after a visa is issued or refused. We keep the outcome, never the underlying document.

  • Least-privilege access

    Filing staff see only the documents for applications assigned to them, only while that application is open. Every access is logged with a reason code.

  • No third-party document sharing

    Scans go to the relevant government authority and nowhere else. They are never used for model training, analytics or advertising.

  • Regional data residency

    Indian applicant data stays in ap-south-1. GCC data stays in me-central-1. Neither is replicated outside its region.

  • Independent testing

    Third-party penetration tests twice yearly, plus continuous automated scanning. Summary reports are available under NDA to partners.

Disclosure

Reporting a vulnerability

  1. 1

    Send it to security@abizonvisa.com

    Include the affected endpoint, reproduction steps, and what you were able to access. Encrypt with our PGP key if the finding is sensitive.

  2. 2

    We acknowledge within 24 hours

    A named engineer responds — not an autoresponder. If we cannot reproduce it, we will tell you what we tried.

  3. 3

    Triage within 72 hours

    You get a severity assessment and a target fix date. Critical findings affecting document storage are treated as an incident immediately.

  4. 4

    Fix, verify, credit

    We ask you to confirm the fix. With your permission we credit you publicly. Bounties are paid for anything rated high or critical.

Safe harbour

We will not pursue legal action against researchers acting in good faith under this policy. Testing against your own account is always in scope.

Out of scope

Please don't test against other people's applications, run automated scans that degrade service for travellers, or attempt social engineering against our filing staff. Those affect real people mid-application.

Detail

Retention, in plain terms

The single question we get asked most is how long we keep a passport scan. The answer is 30 days after your application reaches a final outcome, whether that outcome is an approval or a refusal.

What is deleted

  • Passport bio-page scans and any additional passport pages you uploaded
  • Photographs, including any generated by the Visa Photo Creator
  • Bank statements, income tax returns and employment letters
  • Invitation and cover letters containing third-party personal data

What is retained

  • The application outcome, destination, and dates — needed for the guarantee
  • Your visa number and validity, so you can retrieve it from your profile
  • Payment records, retained for seven years as Indian tax law requires

Why we keep the outcome

Approval and refusal outcomes are what make Rejection Recovery work, and they are what the on-time guarantee is measured against. They contain no document content — only the result and its timing.

You can request earlier deletion at any time by writing to privacy@abizonvisa.com. If your application is still open, note that deleting documents mid-filing will end it.