Security at Pactinel

This page describes how Pactinel is designed and operated. It states what is implemented as of October 2026. Where something is planned but not in place, it says so.

Encryption

Traffic to Pactinel uses TLS 1.2 or higher with HTTP Strict Transport Security. Disks are encrypted. Documents are encrypted at rest in object storage using envelope encryption. Bank details, tax identifiers, API and webhook secrets and authenticator secrets are additionally encrypted at field level with AES-256-GCM, using a separate key for each workspace derived from a master key. A key rotation job exists. Customer-managed keys are not offered.

Tenant isolation

Every row of customer data carries its workspace. The application filters by workspace on every query, and PostgreSQL row-level security, enforced for the application's database roles, is a second line of defense. An automated test fails the build if any tenant table lacks row-level security. Cache keys, object keys, messages and AI usage records are tagged with the workspace. Files are served only through short-lived signed links after an authorization check. A request for another workspace's record returns "not found", so that its existence is not revealed.

Access control

Access is role-based, with record-level scopes and a confidentiality setting for sensitive contracts. Authorization is enforced by the API; hiding a button is never treated as a control. Sessions use opaque, HttpOnly, Secure cookies with origin checks, a server-side session store, a device list with remote sign-out, and refresh rotation with reuse detection. Passwords are hashed with a modern algorithm and checked against a bundled list of common passwords without any external call, and repeated failures lock the account. Two-step verification with an authenticator app is required for Owners and Admins by default, and always required for a full archive export. Single sign-on with OIDC, an IP allow-list and a download watermark are planned or available only on the plan that lists them.

Application security

We build to the OWASP Application Security Verification Standard level 2 as a target. The site uses a strict content security policy. Documents are rendered in a sandboxed viewer on a separate origin. Uploads are limited to allowed file types, checked by content, scanned for malware and limited in size, and a file cannot be downloaded before the scan passes. Dependencies are scanned for known vulnerabilities. An automated scan with OWASP ZAP is planned before launch, and an external penetration test is planned once the business reaches a revenue milestone. Neither has been completed as of October 2026.

Support access

Pactinel staff cannot see your contracts by default. Support access exists only when you grant it. A grant is time-limited, scoped, revocable and visible: every request is written to your audit log and you are notified. Sensitive fields are masked, downloads are blocked, and contracts marked strictly confidential are never visible.

Audit log

Pactinel records every read of a document, every change, every export, every permission change and every AI question, with who, when and from where. The log of each workspace is append-only for the application and chained by hash so that tampering is detectable. You can filter and export it.

AI and your data

Documents sent for extraction are reduced to the relevant pages, with unnecessary personal data such as emails, phone numbers and identifiers masked first. Customer data never trains a model. You can turn AI off for your workspace. See the AI principles.

Backups and continuity

A nightly backup copies every database and the document store on the server, keeping 14 daily and 8 weekly versions with a checksum manifest. Restores are rehearsed monthly. The recovery point objective is 24 hours. Off-site copies are not yet in place, and there is no contractual uptime commitment. If email, AI or an index source is unavailable, work queues and retries, and the product shows an honest state instead of losing data. Written runbooks cover restore, key loss, AI provider outage, billing webhook backlog, index source failure, email deliverability and data breaches.

Incidents

If a personal data breach affects your data, we notify the workspace owner without undue delay, with what happened, which data is affected, what we did and what you should do, so that you can meet your own notification duties.

Certifications and assurance

As of October 2026 Pactinel holds no third-party security certification or independent attestation report. We have built the controls described here from the start and may pursue independent assurance later. We will not claim a certification before it exists. A security pack with questionnaire answers, the subprocessor list and the data processing agreement is prepared for customers who need it, and you can ask for it through the contact page.

Responsible disclosure

If you believe you have found a vulnerability, please report it through the contact page and choose the security category. Include enough detail to reproduce the issue. Please do not access data that is not yours, do not disrupt the service and give us a reasonable time to fix the issue before you share it. We will acknowledge your report, keep you informed and not take action against good-faith research that follows these rules. We do not run a paid bounty program.