Security
A signed agreement is only worth as much as the trust both parties can place in it. Here is how we design Pactlo to protect your information and your records.
Tamper-evident agreements
- When an agreement is completed, we seal the final document and record a cryptographic fingerprint (hash) of it.
- Every step of signing, such as viewing, consenting, verifying and signing, is recorded in an audit trail that cannot be edited, with each entry linked to the one before it.
- Both parties receive the same sealed copy with a completion certificate, so either one can show what was agreed.
Protecting data
- All connections to Pactlo use HTTPS (TLS). We use HTTP Strict Transport Security.
- Data is stored with providers that encrypt it at rest, in data centers in the United States.
- Our database is not exposed to the public internet through client-side keys; only our servers can read and write data.
- Documents are stored privately and are shared only through short-lived, signed links.
- Payment card details are handled by Stripe and never reach our servers.
Access
- Only team members who need access to run and support Pactlo have it, and administrative access requires multi-factor authentication.
- We do not look at the content of your agreements except when you ask us to for support, to investigate abuse, or when the law requires it.
Verification and abuse prevention
- Signers verify their email address or phone number with a one-time code before signing.
- We rate-limit verification codes and restrict text messages to the countries we serve, to prevent fraud.
Reporting a security issue
If you believe you have found a security vulnerability in Pactlo, please email security@pactlo.com with details. We will acknowledge your report, investigate, and keep you informed. Please do not access other people’s data or disrupt the service while testing.