Security & Compliance, Built Into the Platform

How Kemicard keeps wallet passes, member data, and your Salesforce org secure — from OAuth-scoped connections to a stateless pass server that never stores business data.

Your data stays in Salesforce

Kemicard is a managed package running inside your org. Member records, templates, and scan events live in Salesforce under your existing sharing rules, profiles, and permission sets — there is no second database to govern.

Stateless Kemicard Server

Pass generation and cryptographic signing run on the stateless Kemicard Server. Data is used only for the lifetime of each request: no PII or customer content is persisted, and only minimal request metadata is retained temporarily under strict retention policies.

OAuth 2.0, scoped and revocable

Salesforce talks to the Kemicard Server through a Connected App with tightly scoped, short-lived OAuth tokens. Your admin explicitly authorizes the app and can revoke access at any time from Setup.

Encryption everywhere

Every endpoint enforces TLS in transit; passes carry unique identifiers for fraud prevention, and Apple .pkpass bundles are signed with managed certificates so they cannot be tampered with.

Salesforce security review

Kemicard is distributed through the AppExchange, which requires passing Salesforce's partner security review — an independent bar covering code, storage, and integration practices.

Privacy compliance, simplified

Because business data is never stored outside Salesforce, GDPR and CCPA obligations stay where your existing controls already are. Deleting a record in Salesforce is the single source of truth. This describes where the data sits, not a compliance opinion — your own counsel should confirm your position.

Looking for policies, fraud controls, and the full trust documentation? Visit the Kemicard Trust Center or read the technical architecture.

Anti-sharing & anti-duplication

Four Layers of Control Over Card Sharing

For high-value cards — benefits, access credentials, paid memberships — Kemicard layers multiple defenses so one card serves exactly one person.

1. Wallet-level sharing controls. The first line of defense: configure the template so Apple Wallet and Google Wallet themselves block the built-in share options on the pass.
2. Know the iCloud caveat. Apple automatically syncs Wallet passes to other devices signed into the same iCloud account. That's expected behavior for one person's devices — but it's why wallet-level controls alone aren't enough for high-value cards.
3. Kemicard multi-device detection. Our proprietary mechanism detects when one card has been installed on multiple devices and changes the card's visual appearance to show it — so the duplicate is obvious at a glance and at the door, where the Scanner also flags it.
4. Controlled download links (custom-built). For clients who need it, we can custom-build download-URL policies: the add-to-wallet link invalidates after the first download, after a set number of downloads (say, two), or outside a defined date range.