Security at Pact

Last Updated: September 1, 2026

1. How Your Account Is Protected

• Passwords are never stored in plain text — Pact stores only a salted hash, using the same one-way hashing standard (bcrypt) used across the industry.
• Optional two-factor authentication (2FA) is available to every profile from Account Settings — a time-based code from an authenticator app, plus one-time backup codes for account recovery. It's required for Business/Everyday-tier-and-above organization admins before they can invite teammates or change member roles, since those actions extend access to other people's data.
• Session cookies are marked httpOnly (unreadable by page scripts, closing off a whole class of cross-site scripting attacks) and, in production, secure (HTTPS-only, never sent over an unencrypted connection).
• Login lockout — an account locks after repeated failed password attempts and can only be unlocked with a freshly issued temporary password, sent to the account's verified email.
• Closing an account disables its login immediately (see the Privacy Policy's Account Closure & Data Retention section) — the moment you close it, no valid session can be created for it again, reactivation aside.

2. How Your Data Is Protected

• Data is encrypted in transit (HTTPS) between your browser and Pact's servers.
• Contract access is profile-gated end to end — viewing, editing, downloading, sending, or signing a contract all require a verified Pact login and a real relationship to that contract (owner, named party, or someone it's been explicitly shared with).
• Every contract carries a full audit trail — who viewed, edited, and signed it, and when — generated server-side, never by the browser, so it can't be altered by whoever's looking at it.
• Payment details never touch Pact's own servers — they go directly to Stripe's hosted, PCI-compliant Checkout page.

3. Sub-Processors — Who Else Touches Your Data

Pact shares data only with the specific service providers needed to run the features you use — never for advertising, and never sold. This list is the same one published in the Privacy Policy, Section 4, rendered here from the same underlying list so the two can't drift out of sync:

4. Reporting a Security Issue

If you believe you've found a security vulnerability in Pact — anything from an access-control gap to a way to see data you shouldn't be able to — please tell us before disclosing it publicly, so we have a chance to fix it first.

Email security@pactappstore.com with as much detail as you can: what you found, the steps to reproduce it, and its potential impact. We investigate every report and will respond to acknowledge receipt. Please avoid actions that could affect other users' accounts or data (no exfiltrating real user data, no denial-of-service testing) — testing against your own account and reporting what you find is exactly what this is for.

This is not (yet) a paid bug bounty program — but a good-faith report made through this channel, that doesn't cross the lines above, is something we're grateful for, not something we'll treat as an attack.

5. Questions

General security questions that aren't a vulnerability report: security@pactappstore.com. For anything about what data we collect and why, see the Privacy Policy.