Handing a formation service a copy of your passport is a reasonable thing to hesitate over. Here's exactly why we need it, and exactly what happens to it afterward — not a vague privacy-policy summary, the actual mechanics.
Why it's needed at all
Two concrete reasons, not general "verification": the IRS and the registered agent need to know who owns the company, and the name on your EIN application (Form SS-4) has to match your passport exactly — a mismatched name is one of the more common reasons an EIN application gets kicked back.
Who can actually see it
Only you and the founder can view your passport file. It's never exposed through a public link — every access happens through a short-lived link generated on demand, not a permanent URL anyone could stumble onto or share.
Every view is logged
Every time the founder opens your passport file, that access is logged — who viewed it and when. There's no way to view a client's passport without leaving a record of having done so.
When it's deleted
Your passport file is deleted 6 months after your order is delivered. It isn't kept indefinitely "just in case" — once the retention window most relevant to your filing has passed, it's gone.
What we tell clients honestly
We're not a law firm, and we're not going to pretend a document upload is risk-free. What we can tell you concretely is: no public exposure, every view logged, and a fixed deletion date — the same standard we'd want applied to our own documents.