What documents can PassportScan Cloud scan?

PassportScan Cloud supports over 13,000 document types including passports, national ID cards, visas, driver licences and residence permits from any country. It also supports QR-based and digital IDs.

Is PassportScan Cloud GDPR compliant?

Yes. PassportScan Cloud is fully GDPR compliant. All guest data is encrypted, stored in a secure cloud server, and automatically deleted according to customisable retention rules. The system includes a full digital consent and audit trail.

Does PassportScan Cloud integrate with hotel PMS systems?

Yes. PassportScan Cloud integrates with all major Hotel Property Management Systems (PMS), including Oracle Hospitality, Mews, Cloudbeds, Protel, and many more. Guest data is automatically synced after each scan.

Is there a free trial available?

Yes. PassportScan Cloud offers free activation with no hidden charges. You can activate it for free and use it forever on the basic plan, with no credit card required.

How does the hotel self check-in kiosk work?

Guests approach the kiosk in the hotel lobby, scan their passport or ID, find their reservation, complete and sign their registration form digitally, then collect their room key at reception. The entire process takes less than one minute.

Sub-processor Register

Version: 1.0
Last Updated: 03/09/2026

1. Purpose

This document identifies the third-party sub-processors engaged by GlobeID Limited (“GlobeID”) to process Personal Data on behalf of Customers in connection with the PassportScan Cloud services, in accordance with Article 28(2) and 28(4) of the GDPR.

This Sub-Processor List forms an integral part of the Data Processing Agreement (DPA).

2. General Principles

Sub-processors are engaged only where strictly necessary to provide the Services
All sub-processors are bound by written data protection agreements imposing obligations no less protective than those set out in the DPA
GlobeID remains fully liable for the acts and omissions of its sub-processors in accordance with Article 28(4) GDPR
Core platform databases are hosted exclusively within the European Union (AWS eu-west-1 – Ireland)
Where regional S3 storage is enabled, document images are stored in the AWS region corresponding to the hotel’s operational jurisdiction
No cross-region replication of core databases is configured
PassportScan Cloud does not maintain a Cardholder Data Environment (CDE)

3. Authorized Sub-Processors

Sub-Processor	Service Category	Purpose / Function	Data Categories Processed	Processing Location
Amazon Web Services, Inc. (AWS)	Cloud Infrastructure & Hosting	Hosting of application services, databases, encrypted object storage (S3), backups, infrastructure security	Identity data, reservation data, logs, document images (where enabled)	Core: EU (Ireland – eu-west-1). S3: region aligned with hotel jurisdiction (may include non-EEA regions)
Clerk, Inc.	Identity & Authentication	User authentication, identity verification, session lifecycle management	Email address, IP address, device metadata, session tokens	As disclosed in Clerk documentation
Datadog, Inc.	Logging & Monitoring	Infrastructure monitoring, application performance monitoring, security logging, anomaly detection	Log metadata, IP addresses, authentication events, technical diagnostics	EU (Datadog EU site – datadoghq.eu)
Google LLC (reCAPTCHA Enterprise)	Bot Protection & Abuse Prevention	Bot and abuse protection for the guest-facing self check-in application	IP addresses, device signals	As disclosed by Google
Stripe, Inc.	Payment Processing	Credit purchase transactions and account activation	Processed by Stripe: payment card data, billing details, transaction identifiers. Received by PassportScan Cloud: transaction ID, payment status, amount, currency, billing email (if provided)	As disclosed in Stripe documentation

4. Explicit Exclusions

Identity-document OCR is performed by an engine operated entirely within GlobeID’s own AWS environment: document images are never sent to an external OCR provider
Internal tooling operated by GlobeID (operations platform, CI/CD, VPN) is not a third-party sub-processor; the underlying hosting is covered by the AWS entry above
No sub-processor other than AWS, which as hosting provider manages server-side encryption at rest, has access to identity document data
PassportScan Cloud does not store or process raw payment card numbers, CVV codes, or expiration dates
Stripe processes cardholder data within its PCI-DSS compliant infrastructure
No cross-region replication of primary production databases is enabled

5. International Data Transfers

Where sub-processors process data outside the European Economic Area (EEA), GlobeID ensures that appropriate safeguards are implemented, including Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms in accordance with GDPR Chapter V.

For regional S3 storage outside the EEA, transfers are based on the AWS Data Processing Addendum and applicable SCCs.

6. Updates and Notifications

GlobeID may update this Sub-Processor List from time to time.

In accordance with GDPR Article 28(2) and the notification mechanism and notice period set out in the DPA, GlobeID will inform Customers in advance of any intended addition or replacement of sub-processors, giving Customers the opportunity to object, and will publish an updated Sub-Processor List.

Where required by applicable law or the DPA, Customers may object in accordance with the contractual procedure set out in the DPA.

The most recent version of this document will always be published with the updated date.