Trust · Security
pactflow sits between your agents and everything they touch: your models, your tools, your data, your customers. A system in that position doesn't get to be casual about security, so we built it the way we'd audit it.
TLS 1.2+ on every connection in and out of the platform, AES-256 for everything at rest, and keys held in an HSM-backed KMS with automatic rotation. No plaintext path exists between an agent and the control plane.
Each tenant gets its own data plane; no shared queues, no shared indexes. In-VPC deployments go further: prompts and completions stay entirely inside your boundary and never transit pactflow-operated infrastructure.
Employee access requires SSO with MFA, production access is just-in-time and expires by itself, and standing access is zero. Every grant is scoped to a ticket and shows up in the same audit trail our customers get.
Every enforcement decision lands in an append-only, hash-chained log. Each entry commits to the one before it, so tampering breaks the chain visibly. Stream it to your SIEM and verify it independently of us.
Compiled policies are content-addressed and signed at build time, and the enforcement layer refuses to load any artifact whose signature doesn't verify. Nobody, including us, can swap a policy underneath a running agent without the change appearing in the audit chain first.
Annual SOC 2 Type II and ISO 27001 audits, penetration tests by an external firm twice a year, and dependency scanning on every build. Findings get owners and deadlines, not a spreadsheet to age in.
Auditors want artifacts, not assurances. Change Control turns this page into evidence: every approval, diff, and rollback, exportable.
Fail-closed by design
Most gateways fail open: lose the policy service, and traffic sails through unchecked. pactflow inverts that. If the enforcement layer can't reach a valid, signed policy decision, agent calls either queue for replay or deny outright, per the behavior you configure for each agent class. The one outcome that can't happen is an un-reviewed call reaching your users.
How enforcement worksResponsible disclosure
Report vulnerabilities to security@pactflow.xyz and you'll get a human acknowledgement within one business day. Good-faith research under our published guidelines is covered by safe harbor: we won't pursue legal action, and we run a private bounty program for researchers who want to go deeper. How we handle personal data is covered in the Privacy Policy.
# /.well-known/security.txt Contact: mailto:security@pactflow.xyz Policy: https://pactflow.xyz/security.html Preferred-Languages: en Expires: 2027-07-01T00:00:00Z ✓ acknowledged within one business day