Security & compliance

In production today

• SOC 2 Type II data layer

  Our cloud-managed Postgres provider holds SOC 2 Type II attestation. The attestation report is available to enterprise customers under NDA on request.

• 99.9% availability target on Team

  Managed Postgres, with read routing built to send heavy analytics reads to a replica and keep them off the write path. Pro targets 99.5%. A contractual SLA, if you need one, is set in your order form.

• Encryption at rest + in transit

  AES-256 at rest across compute and storage. TLS 1.2+ on every public endpoint. Contact emails and phone numbers can be field-encrypted under keys your workspace controls (BYOK: Azure Key Vault, AWS KMS, or Google Cloud KMS).

• Every release gated against production

  Before a deploy, migrations must form one chain and a destructive one must be marked; they run in an isolated release machine before traffic moves. After it, the release is checked on every machine — the intended build, workspace isolation, and webhook refusal — and a check that cannot run fails.

• Isolation tested before every merge

  Workspace-isolation, auth, PII, and consent tests run as a critical tier that every change must pass before it can merge. Tests run on their own databases, never against production state.

• Tenant isolation in the application

  Every request takes its workspace from the signed-in session, never from the request, and every workspace-scoped row carries its workspace id. Five cross-workspace reads found by our own audits have been closed, and isolation policies cover 783 of 783 workspace-scoped tables. The database-level half is below, under In progress.

• Append-only audit log

  Every audit event is protected by a database trigger that refuses edits and deletes. Rows leave only when the retention window you set (12 months to 20 years) expires. Operators can search the log; tenants can export it as CSV, JSONL, or XLSX.

• Consent matrix per contact

  Per-jurisdiction (GDPR / CCPA / CASL / others) consent state per contact per channel, with point-in-time history. Every send passes the consent check and the frequency cap before it leaves Pact.

• DSAR fulfilment

  Right-to-access, right-to-rectification, right-to-erasure, and right-to-portability requests are first-class data-flow objects, not a quarterly compliance scramble. SLA-tracked from receipt.

In progress

• Pact's own SOC 2 report

  Pact's own SOC 2 Type II report (application tier, not just the data layer) is planned. Today there is a complete policy library mapped to all 33 Common Criteria and an evidence engine, machine-validated in CI — and no audit yet. Until there is, we claim SOC 2 only on the substrate.

• Database-level tenant isolation

  Making the database itself refuse a query that forgets is built and staged, and is not switched on today. We will say so here on the day it is.

• External penetration testbeing scheduled

  An independent firm will test the application and API by hand, signed in, across roles and across workspaces.

  Ready for the testers

  • Scope and rules of engagement
  • An inventory of every API route and how it authenticates, generated from the code
  • One-command test workspaces that hold sample data only

  Once the test and its fixes are complete, a summary and the firm's attestation letter will be published here, and enterprise customers will be able to request the full report under NDA.

  Found something before then? Responsible disclosure is open now.

• ISO 27001

  All 93 ISO 27001:2022 Annex A controls are mapped in code, with a generated Statement of Applicability. We'll publish a target date when the certification audit is booked.

Sub-processors

The complete sub-processor schedule — specific providers, certifications, DPA-on-file dates, and change-notification subscription — is published on our Trust Center or available on request at legal@pact.place. AI features (where enabled for your tenant) use Anthropic by default; no data is sent to any AI provider unless the feature is explicitly enabled for your tenant.

Retention & deletion

By default we retain customer data for the term of the contract plus 30 days for recovery. Tenants can request earlier deletion at any time; the same DSAR machinery that handles end-user erasure handles tenant-wide deletion. Backups roll out of point-in-time history within 7 days.

Reporting a vulnerability

Found something? Email security@pact.place. We acknowledge within 2 business days and keep you updated through remediation. The coordinated disclosure window is 90 days from acknowledgement, and we move faster when the issue is critical. Good-faith research is covered by our safe harbor.

Read the full disclosure policy · machine-readable at /.well-known/security.txt