Trust · Security

Built like the control plane it is

pactflow sits between your agents and everything they touch: your models, your tools, your data, your customers. A system in that position doesn't get to be casual about security, so we built it the way we'd audit it.

Six controls, none of them optional

Encryption everywhere

TLS 1.2+ on every connection in and out of the platform, AES-256 for everything at rest, and keys held in an HSM-backed KMS with automatic rotation. No plaintext path exists between an agent and the control plane.

Tenant isolation

Each tenant gets its own data plane; no shared queues, no shared indexes. In-VPC deployments go further: prompts and completions stay entirely inside your boundary and never transit pactflow-operated infrastructure.

Least-privilege access

Employee access requires SSO with MFA, production access is just-in-time and expires by itself, and standing access is zero. Every grant is scoped to a ticket and shows up in the same audit trail our customers get.

Signed audit log

Every enforcement decision lands in an append-only, hash-chained log. Each entry commits to the one before it, so tampering breaks the chain visibly. Stream it to your SIEM and verify it independently of us.

Policy-engine integrity

Compiled policies are content-addressed and signed at build time, and the enforcement layer refuses to load any artifact whose signature doesn't verify. Nobody, including us, can swap a policy underneath a running agent without the change appearing in the audit chain first.

Continuous testing

Annual SOC 2 Type II and ISO 27001 audits, penetration tests by an external firm twice a year, and dependency scanning on every build. Findings get owners and deadlines, not a spreadsheet to age in.

Auditors want artifacts, not assurances. Change Control turns this page into evidence: every approval, diff, and rollback, exportable.

Fail-closed by design

If the engine goes dark, agents don't go ungoverned

Most gateways fail open: lose the policy service, and traffic sails through unchecked. pactflow inverts that. If the enforcement layer can't reach a valid, signed policy decision, agent calls either queue for replay or deny outright, per the behavior you configure for each agent class. The one outcome that can't happen is an un-reviewed call reaching your users.

How enforcement works
enforcement · fail-closed
policy engine · heartbeat lost unreachable
support-agent · zendesk.read queued
billing-agent · refund.create denied
engine restored · queue replayed governed

Responsible disclosure

Found something? We want the bad news

Report vulnerabilities to security@pactflow.xyz and you'll get a human acknowledgement within one business day. Good-faith research under our published guidelines is covered by safe harbor: we won't pursue legal action, and we run a private bounty program for researchers who want to go deeper. How we handle personal data is covered in the Privacy Policy.

# /.well-known/security.txt
Contact: mailto:security@pactflow.xyz
Policy: https://pactflow.xyz/security.html
Preferred-Languages: en
Expires: 2027-07-01T00:00:00Z
✓ acknowledged within one business day

Security your auditor can verify, not just read.