You are about to hand a website your passport number. That deserves more than a reassuring sentence, so this page sets out exactly how your details are encrypted, who they are shared with, how long we keep them — and how you can check each of those claims for yourself.
At a glance
You are handing a website your passport number. Here is precisely what happens to it — described in enough detail that you could hold us to it.
Every page and every form submission on myarrival.com travels over HTTPS/TLS, so nothing you type is readable between your device and us. Session cookies are HttpOnly and SameSite, which stops other sites — and scripts on this one — from reading or replaying your login.
Passport numbers, dates of birth and every answer you give in the form are encrypted with AES-256 before they are written to our database. A stolen copy of the database is not a stolen copy of your passport.
Card details are passed straight to our payment provider over an encrypted connection to authorise the charge, and are never written to our database or our logs. Apple Pay and Google Pay never expose a card number at all — your browser hands us a single-use token instead.
Each country form is built from that government's own requirements. If a field is not required for your destination it never appears — so we never hold it, never transmit it, and never have to protect it. The cheapest data to secure is the data you did not collect.
Application data is kept for up to 90 days after delivery so we can re-send your confirmation if you lose it, then anonymised or deleted. If you have an account, your data stays until you delete it — and you can delete it. Payment records are kept for seven years because accounting law requires it.
Our own people do not all see everything: staff accounts are scoped to the destinations they work on. Every status change on an application is written to an append-only audit log, so who did what — and when — is a matter of record rather than memory.
Our public forms are rate-limited and bot-checked, and failed or stuck submissions raise an internal alert automatically rather than waiting for a customer to notice. We would rather find our own problems first.
Your details go to the destination government, our payment provider, and our hosting and email providers. That is the complete list — we do not sell data and we do not pass it to marketing partners. The full breakdown is in our privacy policy.
Found a security problem on this site? Email info@myarrival.com with the details. We will confirm receipt, fix it, and we will not come after anyone who reports something in good faith.
Every claim we make on this page comes with a way for you to test it yourself. Please do.
What we claim
How you can check it
We are a real, registered company
Our registered legal name and postal address are printed in the footer of our public pages and on every invoice we issue. Compare the two — they should match exactly.
Your connection to us is encrypted
Click the padlock in your browser's address bar and inspect the certificate. It should be issued to myarrival.com — nothing else.
We are an independent service, not a government department
We say so on our disclaimer page, in our help centre, and in the footer of our homepage. The card itself is issued by the destination government — what we do is prepare, submit and deliver the application.
Your arrival card is the genuine article
What we deliver carries the destination government's own reference or card number. You can present it at the border, and where the destination offers a public lookup you can check it there yourself.
The price is itemised, not marked up in the dark
Every line is named on the checkout page before you pay and again on your invoice — the destination's own charge, our processing fee, and anything optional you chose. Compare the destination's line with its published fee.
A human answers the email
Write to info@myarrival.com and find out. We aim to reply within a few hours; there is no chatbot in front of the inbox.
MyArrival is operated by the company below. The same details appear on every invoice we issue, so the two can always be compared. There is one public mailbox — we deliberately run no department-specific addresses that nobody reads.
Good. Ask about our data handling, our fees, or anything on this page that sounds too smooth. A vague answer from a travel service is itself an answer.