What HeyPass is not for

Financial accounts

Banking, payments, brokerage, lending, insurance, crypto exchanges or wallets. No verification code from a financial institution may be routed through HeyPass, by anyone, for any reason. We block sender domains identified as belonging to financial institutions, and we do not treat that as a defect.

Health data

Medical records, patient portals, insurance claims, prescription services, or anything constituting protected health information. HeyPass is not HIPAA compliant, has not been assessed for it, and will not sign a business associate agreement.

Government and identity systems

Tax portals, immigration or visa systems, national identity schemes, benefits systems, court or law enforcement systems, or anything issuing or verifying a government credential.

Payment card data

HeyPass is not PCI DSS assessed. Keep cardholder data away from it.

Accounts you do not control

Any account belonging to another person or organisation, whether or not you hold the password, and whether or not you were told it was fine.

Personal accounts

An individual’s own email, social, banking, health or shopping accounts, including your own. HeyPass is for accounts an organisation holds.

Reselling access

Renting, reselling, brokering or otherwise commercialising access to a shared account, including group buys and account sharing services.

Circumventing another provider

Working around a restriction, seat limit or term imposed by a service you do not own.

Defeating someone else’s security

Bypassing multi-factor authentication, device verification or any other control protecting an account that is not yours.

Minors

Any account belonging to or operated by a person under 18.

Unlawful or abusive activity

Fraud, phishing, spam, harassment, stalking, or anything illegal where you or the affected person is located.