Your contracts are your most sensitive data. We built for that first.
Tenant isolation, policy checks on every request and an audit trail that can't be edited. Here's how it works, and where our certifications stand today.
Controls at every layer
Pactone is a multi-tenant service with zero-trust controls throughout. Our threat model covers external attackers, malicious insiders, prompt injection, cross-tenant access and credential theft, and we review it every quarter.
Tenant isolation
Every table carries a tenant ID and a Postgres row-level security policy, so one customer's queries can't reach another's data.
Policy-checked requests
Every server function and route calls Open Policy Agent before it runs. Policies live in version control and are peer-reviewed and tested.
Role-based access
Eleven roles, enforced in the database, the application and the interface, and always verified on the server.
Tamper-evident audit
An append-only, hash-chained log of AI calls, human decisions, workflow changes, access checks and sign-ins. Seven-year default retention.
Identity
Email and password with lockout, plus Google sign-in. Enterprise adds SAML SSO, TOTP MFA and IP allow-listing.
API protection
Per-tenant and per-IP rate limits, schema validation, strict CORS, short-lived tokens with rotation, and scoped keys for integrations.
Encrypted, contained and never used for training
- Encryption. AES-256 at rest with database-level encryption, and TLS 1.2 or higher with forward secrecy in transit.
- No training on your contracts. Customer data is never used to train shared models. AI processing is ephemeral.
- Data residency. Enterprise customers can choose where their data is hosted. Ask us for the current list of regions.
- Backups. Retention from 30 to 365 days, with customer-managed keys available.
Humans make the call
- Explainable output. Every AI suggestion shows its reasoning and a confidence score.
- Mandatory review. A person approves before anything is executed.
- Revalidation. Human edits are rechecked for any risk they introduce.
- Full record. Recommendations and decisions are logged with before and after state.
Where we stand today
We'd rather tell you exactly where we are than put a badge on the page early. Pactone does not yet hold a SOC 2, ISO 27001 or HIPAA attestation. The work is under way and we'll update this page as each one completes.
A data processing agreement is available on request.
| Framework | Status |
|---|---|
| SOC 2 Type II | Audit in progress |
| HIPAA | In progress |
| ISO 27001 | Planned |
| GDPR | DPA available |
| NIST CSF 2.0 | Controls aligned |
Found a vulnerability?
Email security@pactone.ai with the details and steps to reproduce. We acknowledge reports within 24 hours and keep you informed until the fix ships.
Please give us reasonable time to fix the issue before sharing it publicly, and don't access or change data that isn't yours.
See it on a contract you know
Open the live demo with no signup, or send us a sample agreement and we'll walk your team through it.