How Passabot kept card security in step with 80% monthly growth

Passabot was founded in 2025 by a team of former Insper scholarship students. It started as a consumer service: travelers chatted with a WhatsApp bot to find the best airfare. Within months, the team spotted a bigger opportunity. Travel agents were juggling a separate system for every supplier, so Passabot started building tools to bring everything together. That became PassHub, launched in December 2025. With one sign-up, an agency can compare and book flights from several suppliers, plus bus tickets, hotels, travel insurance and group trips, with no monthly fee. Agencies signed up fast: about 100 in the first month, and more than 3,000 today, with R$180 million in annualized sales.

Almost every booking on PassHub involves a payment card. In the early days, that card data passed through several of Passabot’s own systems before reaching the airline or supplier. Even encrypted, it was still data Passabot held, and any company that handles card data must meet PCI DSS, the strict security standard set by the card industry.

At Passabot’s pace, that became a real problem. Every new system, server or log that touched card data added to the work of proving it was secure. On top of that, Passabot needed PCI DSS compliance to be accredited by IATA, the global airline association.

“Security and compliance were the same problem seen from two angles: the cheapest and safest way to protect data is not to have it.” Fernando Santos, Co-Founder & CTO at Passabot.

Passabot's answer was to keep card data out of its infrastructure. With PCI Proxy, card details are captured in secure payment fields hosted by PCI Proxy, and Passabot only ever receives a stand-in code, called a token.

When it's time to charge, PCI Proxy's Forward API swaps the token back for the real card details and sends them directly to the airline or supplier. Returning customers can still save their cards, without Passabot ever storing the real number.

The first supplier was connected and taking payments in just three days, and the second followed three days later.

Every travel supplier has its own way of receiving payments, and some come with strict, unusual security requirements. PCI Proxy handled them all through the same connection. Today five suppliers and Passabot’s own credit product share one setup, and even its WhatsApp channel never sees a card: it simply sends a secure payment link via PCI Proxy.

“At first this technology was all new to us. What makes me recommend PCI Proxy most is the support. They respond super fast and are really attentive.” Fernando Santos, Co-Founder & CTO at Passabot.

Card data no longer touches Passabot's servers in the ticket sales flow, significantly reducing its PCI DSS scope. That leaves Passabot with a smaller set of applicable requirements to manage, making compliance much easier as the business grows. At the same time, Passabot has gone from one supplier to five, and from one product to five, without rebuilding its payments setup or increasing its compliance burden.

“The passenger's card data never enters our infrastructure, and that's why we can grow in agencies and suppliers without every new integration becoming a compliance problem.” Fernando Santos, Co-Founder & CTO at Passabot.

For Passabot, taking card data off its systems turned payment security from a brake on growth into something that no longer slows it down. Next, it wants PassHub to be the one place travel agencies go for everything they sell.

Fernando has clear advice for other Brazilian travel startups. In travel tech, the charge is almost never yours: the airline, the consolidator or the hotel charges the card, each with its own contract and its own way of receiving it. That is the worst scenario for a traditional gateway, and exactly what PCI Proxy is for: you can talk to all of them without ever hosting the card data.

“For a Brazilian startup that works with international suppliers and can’t pause its roadmap to build its own card vault, it’s the difference between a simple integration and a year-long project.” Fernando Santos, Co-Founder & CTO at Passabot.