Security

Last updated: September 29, 2026

Pactlyst will handle sensitive agreements, so security has to be real — not marketing. This page describes what is in place today and what we are building toward. We will not claim protections that are not technically implemented yet.

What is in place today

  • Encrypted connections: pactlyst.com is served exclusively over HTTPS (TLS), so traffic between your browser and our site is encrypted in transit.
  • Limited data collection: the marketing site collects only waitlist email addresses plus basic signup attribution (campaign and referrer details, sent by our own code — no third-party analytics or trackers).
  • Limited access: waitlist data is accessible only to the Pactlyst team member who operates it.

What we are building toward

Before the app launches, our security plan included:

  • Encryption in transit and at rest for uploaded documents and account data. Done: all traffic is encrypted in transit (HTTPS/TLS); account and app data is encrypted at rest by our backend provider, and secrets on your iPhone are kept in the device keychain.
  • Access controls: your agreements are private to your account; team access is limited and logged. Done: an access-control audit verified that every database table enforces per-account access, the temporary upload area is private with no client read access, and secret keys exist only on our servers — never inside the app. One critical issue found during the audit (a database permission that could have let signed-in users grant themselves credits) was fixed and re-verified on September 28, 2026: a live check of the production database confirmed the credit-grant functions can only be run by our servers, the temporary upload area allows no client reads, and every quota table enforces per-account access.
  • Retention & deletion: clear retention periods plus self-service deletion of documents and accounts. Done: see the Privacy Policy for the retention table and the in-app account deletion flow.
  • AI processing transparency: a plain-language explanation of which models and services process your documents, and what they may or may not retain. Done: see "AI & your documents" below and the Privacy Policy.
  • Subprocessor list: a public, current list of third-party services that touch your data. Done: see "Third-party providers" below.
  • Pre-launch review: an in-depth security review of the app before it handles real agreements. Done: a full security review and access-control audit was completed in September 2026, with an incident-response plan in place.
  • On-device encryption: analyses, deals, and research reports stored on your phone encrypted with AES-256 (the key is kept in your phone's secure storage). In testing: implemented and in testing ahead of the next app update — the current app version does not yet encrypt stored documents on the device.

AI & your documents

Document reviews are produced with the help of AI models. Our policy is that your documents are processed to generate your review — not to train shared models. When you scan a document, our server sends it to OpenAI for analysis: PDFs are deleted from OpenAI's file service immediately after the analysis, and photos are sent as part of the request and never stored as a file. OpenAI may keep abuse-monitoring logs for up to 30 days under its default terms, then deletes them; we have not enabled OpenAI's Zero Data Retention option at this time. Your review itself is saved only on your iPhone. Full details are in the Privacy Policy.

Third-party providers

  • Supabase — app backend: accounts, Ask chat history, watched agreements, and the temporary document holding area.
  • OpenAI — the AI that reads your documents and powers Ask chat.
  • Tavily — the web-search service used for due-diligence ("research") reports. When you ask us to research a counterparty (for example, a landlord, employer, or business), we send that counterparty's name to Tavily so it can search the web for lawsuits, fines, and enforcement actions about them.
  • RevenueCat — subscription status and purchase verification.
  • Apple — processes all in-app purchases as the merchant of record.
  • Sentry — anonymous crash and error reporting (no user identity; file paths and document-like filenames are scrubbed on your device before anything is sent).
  • Brevo — waitlist signup forms and the waitlist contact list (brevo.com). Single opt-in signup and automated welcome emails are enabled.
  • Netlify — website hosting.
  • Zoho — business email ([email protected]).
  • Expo — the service that builds the iPhone app.

Each provider's privacy policy and data-processing terms are linked from the Privacy Policy.

Report a security issue

If you find a vulnerability, email [email protected] with the subject "Security report". We will acknowledge it and investigate promptly.