Back toPactLive status and incident history
Trust Center

Compliance you can verify.

The answers a security review asks for, each with the code that makes it true. What is not true yet is written next to it rather than left out. 6 of 7 framework statuses name the modules that implement them; none of them is an audit result.

Uptime commitment: 99.9% on the Team plan, per the Terms of Service.

Certifications & frameworks

SOC 2 Type II

AICPA TSC 2017

In preparation · not yet audited

Automated evidence collection across the five Trust Services Criteria.

Pact runs an automated SOC 2 evidence engine that turns the live state of tenant isolation, RBAC, encryption, audit logging, sub-processor management and data deletion into dated, hash-stamped artifacts. Collection is operator-triggered today — a scheduled nightly run is defined but not yet enabled. Monthly bundles and an auditor package are generated on demand.

Backing code present

ISO/IEC 27001:2022

ISO/IEC 27001:2022

In preparation · not yet audited

Annex A control matrix, risk register and Statement of Applicability.

All 93 Annex A:2022 controls are modelled in code. Controls Pact discharges technically — encryption, access control, logging, deletion — are pre-populated as implemented in the Statement of Applicability with the implementing subsystem cited.

Backing code present

HIPAA

Available

Self-serve Business Associate Agreement and PHI-grade safeguards.

A standard HIPAA Business Associate Agreement (45 CFR §§164.502(e), 164.504(e), 164.314(a)) is generated on demand, hash-stamped for verification, and ready for counter-signature. ePHI is encrypted in transit and at rest; on the Team plan, contact emails, phone numbers and names can also be field-encrypted under a key the workspace holds in its own cloud KMS.

Backing code present

PCI DSS

PCI DSS v4.0 — SAQ A

Not applicable

Pact never stores, processes or transmits cardholder data.

Payment card data is handled entirely by Stripe, a PCI DSS Level 1 service provider. Pact's systems never touch primary account numbers, so the platform is eligible for the SAQ A self-assessment with the smallest possible card-data scope.

SOC 3

Planned

Public-facing general-use report derived from SOC 2 evidence.

A SOC 3 report is the freely-distributable summary of the SOC 2 examination. Pact generates the public-safe subset of its SOC 2 evidence as a SOC 3 summary.

Backing code present

GDPR

Compliant

Consent-native by design; DSR workflow with a 30-day statutory clock.

Consent, lawful basis and suppression are first-class. Data Subject Requests (access, portability, deletion, rectification) run through a tracked workflow with auto-collection, and each erasure records what it removed, table by table. Standard Contractual Clauses are generated for EU transfers.

Backing code present

CCPA / CPRA

Compliant

Consumer rights honored through the same DSR workflow as GDPR.

Access, deletion and opt-out rights under the CCPA/CPRA and the newer state privacy laws (VCDPA, CPA, CTDPA) are served by the unified Data Subject Request workflow and the consent ledger.

Backing code present

Security capabilities

Encryption in transit and at rest

TLS 1.2 or 1.3 on every public endpoint, with HSTS. The database, its backups and object storage are encrypted at rest by the providers. Pact encrypts call recordings, integration tokens and authenticator secrets itself before storing them, and can field-encrypt contact emails, phone numbers and names (AES-256-GCM) under a key your workspace holds in Azure Key Vault, AWS KMS or Google Cloud KMS.

Tenant isolation

A signed-in session or a workspace API key is bound to one workspace, and a request for another is refused. Every tenant table also carries a database row-level policy; that layer is in a staged rollout. CI checks every change for scoping gaps, and the known-gap count only goes down.

Access control

Seven roles from viewer to owner. SAML 2.0 and OIDC single sign-on with an SSO-required switch, SCIM 2.0 provisioning, and a passkey-required switch. Authenticator-app codes confirm sensitive actions.

Append-only audit log

Security-relevant events go to a log the database refuses to edit. It is kept 7 years by default (you can choose 12 to 240 months) and exports as CSV, JSONL or XLSX.

Data subject requests

Access, portability, deletion and rectification requests carry a 30-day clock with escalation. An erasure records what it removed, table by table.

Consent and suppression

Consent and lawful basis are recorded per contact with their history, and a bounce, complaint or unsubscribe suppresses the address before any email goes out.

Included, not sold as add-ons

The controls a security review asks for come with the plan. There is no separate security package, and none of these is priced per event or as a share of spend.

  • Single sign-on

    Pro and Team

    SAML 2.0 and OIDC, with a switch that makes SSO the only way in.

  • SCIM provisioning

    Pro and Team

    SCIM 2.0 user and group provisioning from your identity provider.

  • Audit log

    Pro and Team

    Append-only, kept 7 years by default, exportable as CSV, JSONL or XLSX.

  • Full data export

    Every plan, including Free and the 30 days after you cancel

    One archive with a file per table, a manifest and your audit history.

  • Data subject request tooling

    Every plan

    Access, portability, deletion and rectification, each on a 30-day clock.

  • Bring-your-own key

    Team

    Your key in your cloud KMS for contact fields.

Where each of these is set in the code (14)
  • api/routes/auth_saml.py:71
  • api/routes/auth.py:489
  • web/src/lib/marketing/pricing.ts:82
  • api/routes/scim.py:80
  • alembic/versions/0576_audit_context_and_immutability.py:113
  • api/routes/audit_log.py:589
  • web/src/lib/marketing/pricing.ts:83
  • core/data_portability.py:31
  • core/data_portability.py:104
  • web/src/lib/marketing/pricing.ts:63
  • core/dsar.py:71
  • core/dsar_reach.py:1
  • core/encryption/kek_provider.py:5
  • web/src/lib/marketing/pricing.ts:103

Paths in Pact’s source code, for a reviewer who wants to walk through one with us at security@pact.place.

Encryption

What is encrypted, by whom, and with what. Where the control belongs to a provider, it says so.

In transit

Public endpoints
TLS 1.2 or 1.3 only; TLS 1.0 and 1.1 are refused. HTTPS is enforced, with HSTS for two years.
Application to database
Every connection requires TLS with SCRAM channel binding.

At rest

Database, backups and object storage
Encrypted at rest by the providers (Neon for Postgres and its point-in-time recovery, Fly Tigris for files). This is the providers' control; Pact relies on their attestation.
Call recordings
Encrypted by Pact before upload (Fernet: AES-128-CBC with an HMAC-SHA256 integrity check), on top of the storage provider's encryption.
Integration tokens and authenticator secrets
Encrypted by Pact with the same scheme before they are stored.
Contact emails, phone numbers and names
Can be field-encrypted with AES-256-GCM under a key your workspace holds in Azure Key Vault, AWS KMS or Google Cloud KMS. You turn it on per workspace, and the key-encryption key stays in your KMS.

Not yet: If your key service cannot be reached, the write is stored without field encryption rather than refused.

Passwords and API keys
Passwords are hashed with bcrypt. API keys are stored only as a hash.
Where each of these is set in the code (14)
  • api/security_headers.py:59
  • fly.toml:213
  • web/fly.toml:136
  • docs/ops/transport-edge-audit-2026-09-16.md:125
  • docs/soc2/policies/encryption.md:84
  • core/voice_recordings.py:774
  • core/security/fernet.py:11
  • core/security/fernet.py:5
  • core/iam/totp.py:25
  • core/encryption/envelope.py:16
  • core/encryption/kek_provider.py:5
  • core/encryption/contact_ops.py:24
  • core/passwords.py:34
  • models/api_key.py:70

Paths in Pact’s source code, for a reviewer who wants to walk through one with us at security@pact.place.

Retention defaults

How long Pact keeps each kind of record when nobody changes anything, and what a workspace admin can change.

  • Audit log

    7 years

    You can change it: 12 to 240 months

  • Call recordings

    Off until you turn recording on; then 90 days (7 years for HIPAA workspaces)

    You can change it: Per workspace

    Not yet: The job that deletes a recording when its window ends is not switched on yet, so recordings are kept until you delete them or close the workspace.

  • Signed-in sessions

    7 days idle, 30 days at most

    You can change it: Shorter, per workspace and per role

  • API usage and AI tool-call logs

    90 days

    Fixed

  • Workspace export downloads

    Link valid 7 days; the file is kept 30 days

    Fixed

  • After you cancel

    Full export stays available for 30 days

    Fixed

    Not yet: Deleting the workspace afterwards is done on request, through a pipeline a person approves (export, verify, delete); it does not run on its own.

  • Data subject requests

    Each request carries a 30-day clock, with escalation before it lapses

    Fixed

Where each of these is set in the code (17)
  • core/tenant_settings.py:148
  • api/routes/admin_settings.py:46
  • core/audit_retention.py:1
  • core/voice_recordings.py:457
  • core/voice_recordings.py:458
  • api/worker_bootstrap.py:2109
  • core/tenant_settings.py:142
  • core/tenant_settings.py:143
  • core/iam/session_policy.py:1
  • core/api_monetization/retention.py:44
  • core/mcp_invocation_retention.py:35
  • core/data_portability.py:92
  • core/backup/tenant_export.py:38
  • core/data_portability.py:104
  • core/tenant_lifecycle/due.py:10
  • core/dsar.py:71
  • api/worker_bootstrap.py:115

Paths in Pact’s source code, for a reviewer who wants to walk through one with us at security@pact.place.

Sub-processors

Every third party that can process data on Pact’s behalf. The same register fills Annex II of the Data Processing Agreement, so the two cannot disagree. Revised . Certifications are what each vendor publicly claims, not reports Pact holds.

Always engaged · 5

  • Fly.io

    United States (iad)

    Application and worker runtime — the API, web frontend and background workers

  • Neon

    United States

    Managed Postgres — the primary application database and its point-in-time recovery

  • Cloudflare

    Global edge (US-headquartered)

    CDN, DNS and WAF in front of the web app and marketing site

  • Fly Tigris

    United States

    Object storage — call recordings, exports, archived evidence and uploaded files

  • Resend

    United States

    Email delivery — invitations, password resets, notifications and sequence email

Engaged only when a feature that uses them is in use · 15

A workspace that never places a call sends no audio to a speech vendor. Several of these can also run on a key your workspace supplies, in which case the vendor bills you directly.

  • Anthropic

    United States

    AI model inference for AI features (no training on customer data, per Anthropic's terms)

    When engaged: When a workspace uses an AI feature, on the workspace's own Anthropic key or on Pact's

  • Stripe

    United States

    Subscription billing and payment processing

    When engaged: For workspaces that pay by card; holds the billing contact and payment details

  • Sentry

    United States

    Application error monitoring; error reports can include text from the failing request

    When engaged: When error monitoring is configured for the service

  • Twilio

    United States

    Telephony — calls, SMS and the voice media relay. On relayed calls Twilio's own partners transcribe (Deepgram) and voice (ElevenLabs or Amazon Polly) the audio

    When engaged: When a workspace places or receives calls or sends SMS

  • Deepgram

    United States

    Speech-to-text transcription of calls and in-app microphone audio

    When engaged: When calls are transcribed, on the workspace's own Deepgram key, Pact's, or through Twilio

  • ElevenLabs

    United States

    Text-to-speech synthesis for voice features

    When engaged: When a voice feature speaks, on the workspace's own key, Pact's, or through Twilio

  • AssemblyAI

    United States

    Transcription of voice notes and in-app microphone audio

    When engaged: When a voice note or microphone recording is transcribed with AssemblyAI

  • Recall.ai

    United States

    Meeting bots — joins a meeting and returns its recording and transcript

    When engaged: When a workspace sends a meeting bot to a call

  • OpenAI

    United States

    Supplementary model inference and embeddings

    When engaged: When a workspace routes AI to OpenAI, or a feature that uses Pact's OpenAI key runs

  • Amazon Web Services (S3, SES)

    United States

    Archive of signed e-signature documents (S3); alternate email delivery (SES)

    When engaged: When signed documents are archived to S3, or email falls back to SES

  • Alternate email providers (SendGrid, Postmark or Mailgun)

    United States

    Email delivery when a workspace or Pact routes email through one of them instead of Resend

    When engaged: Only when one of them is configured as the email provider

  • Google Firebase Cloud Messaging and Apple Push Notification service

    United States

    Mobile push delivery — the notification's title and body

    When engaged: When notifications are sent to the mobile app

  • GitHub

    United States

    Product feedback you submit in the app — its text, any voice transcript and the page it came from

    When engaged: When someone submits in-app feedback and the feedback channel is configured

  • Slack

    United States

    Product feedback you submit in the app — the first 500 characters, posted to Pact's own workspace

    When engaged: When someone submits in-app feedback and the feedback channel is configured

  • Customer-selected cloud KMS (Azure Key Vault, AWS KMS or Google Cloud KMS)

    Customer-selected region

    Key-encryption-key custody for tenants using bring-your-own-key

    When engaged: When a workspace chooses to hold its own encryption key

Your data is portable

Your data is portable on every plan — including the Free plan, after a downgrade, and after cancellation. There is no export paywall and no lock-in.

One-click export of every record on every plan.
Read access to your data stays on, even past-due or after cancellation.
Open formats — JSON and CSV — with a documented, versioned schema.
A 30-day grace window after cancellation before anything is deleted.
Export your dataExport schema (v1)

Security & uptime events

No incidents disclosed in the last 90 days. See the live status page.

No incidents have been disclosed in the last 90 days. Live component health and any new incidents appear on the status page.

Coordinated disclosure

Coordinated disclosure — open to everyone

Anyone can report a security issue to security@pact.place. We acknowledge within 2 business days, agree a 90-day disclosure window from acknowledgement, and give good-faith research safe harbor.

Safe harbor. Good-faith research that respects these rules is authorized: no data exfiltration beyond what's needed to prove an issue, no service degradation, no access to other tenants' data, and a 90-day disclosure window before going public. We will not pursue legal action against researchers who follow them.

In scope

  • *.pact.place application and API surfaces
  • Authentication, tenant isolation (IDOR), and access-control flaws
  • Data exposure and injection vulnerabilities

Out of scope

  • Denial of service / volumetric testing
  • Social engineering and physical attacks
  • Findings that require a rooted device or a compromised browser
  • Reports from automated scanners without a working proof of concept
security@pact.place

Vulnerability disclosure

Pact welcomes coordinated disclosure of security issues. Report to security@pact.place; we acknowledge within 2 business days and do not pursue good-faith researchers.

security@pact.placeFull policy & safe harbor

External penetration test: being scheduled. What is ready and what comes next

Documentation

The SOC 2 evidence bundle (generated from Pact's own controls; no audit has been performed) and the ISO 27001 Statement of Applicability are available to customers and prospects under NDA. HIPAA is not supported yet, so don't load protected health information into Pact.

Security overviewPrivacy policy

Powered by Pact — the consent-native CRM. Statuses are read live from Pact’s control registry.