Explainer
How it works
Claims Passport is a privacy-first identity vault shared by every participating class action and compensation site. Here is how the registration flow works, step by step.
01 You encounter a matter on a participating site
Sites like ClassActions.com.au and Underpaid.com.au embed the Claims Passport widget on their matter pages. When you click Register or Check eligibility, the widget opens — the host site does not collect your contact details.
02 You verify your contact method
You choose your preferred contact method — mobile or email — and enter it. Claims Passport sends a magic link to that contact. Clicking the link proves you own the contact method. No numeric code, no password.
Privacy note: Your contact method is sent to the vault for verification only. It is never stored on the participating site.
03 Your name is collected separately
Your preferred name and your contact method arrive in separate API requests. This separation is by design — even the network traffic never combines them.
04 Claims Passport checks for an existing record
The vault computes a one-way fingerprint (HMAC-SHA256) of your contact and compares it against existing records. If a match is found, you already have a Passport — the vault links the new matter to your existing ID. No duplicate registration, no second Passport.
Fingerprint: The fingerprint cannot be reversed to your actual contact details. It exists only for deduplication.
05 Your contact is encrypted and stored
If this is your first registration, the vault generates a fresh data encryption key (DEK), encrypts your contact with AES-256-GCM, then wraps the DEK under GCP KMS (Sydney region). The plaintext DEK is zeroed out immediately.
06 Your Passport ID is issued
You receive a cryptographically random Passport ID in the format CP-XXXXXXXXXXXXXXXX (base58, 16 characters). It is not sequential and cannot be guessed.
The participating site stores only this Passport ID, the matter ID, your intent (claimant or interested), and the source tag.
07 Claude screens your eligibility (in the background)
After registration, the vault sends your anonymised intake answers to Anthropic's Claude for eligibility screening. Claude never receives your Passport ID, name, or contact details. The result — strong, possible, or unlikely — is stored on your matter link and included in the routing payload.
08 Your registration is routed to the right firm
Based on per-matter routing rules, the vault sends a webhook to the assigned law firm partner. The payload contains your Passport ID, matter ID, eligibility result, and a plain-English summary. It never contains your name, mobile, or email.
09 Communications come through your Passport Inbox
Matter updates, notices, and messages arrive in your Passport Inbox. If you have opted in, the vault decrypts your contact just long enough to forward the message via SMS or email — then discards the plaintext immediately.
The short version
You → Widget → Verify contact → Vault encrypts → Passport ID issued → Claude screens → Firm receives summary (no contact) → Inbox delivers updates