Trust Posture — Pactline

← Back to Home

What Pactline protects

Pactline is the approval and evidence layer for high-risk AI actions. Every consent request submitted by an agent — the action title, description, context, risk level, policy decision, approver identity, and timestamps — is stored in a hash-chained audit trail that customers can export at any time.

What we hold on your behalf:

Account and team member identities (name, email, hashed password, MFA state).
Agent registrations and API keys (hashed at rest).
Policy definitions.
Consent requests, decisions, and their audit chain.
W3C Verifiable Credential receipts for approved decisions.

How we protect it

Transport TLS 1.2+ on every public endpoint; HSTS enforced. HTTP is 301-redirected to HTTPS.

Authentication Password + optional TOTP MFA for humans. Hashed API keys with server-side salt for agents. Session cookies are httpOnly + SameSite.

Authorization Every route is scoped to the authenticated user and their team memberships. Admin routes require an admin role verified per request.

Rate limiting & abuse Redis-backed rate limits per route, IP filtering, and request fingerprinting. Fraud detection on state-changing endpoints.

Backups Encrypted PostgreSQL backups every 6 hours with 14-day retention.

Data isolation Redis logical database isolation from other applications on the same host.

Evidence you can verify

Every state transition on a consent request — created, auto-approved, blocked by policy, human-approved, human-denied, expired — writes a hash-chained audit entry. Each entry references the SHA-256 hash of the previous entry, so tampering with a single row breaks the chain from that point onward. On export, Pactline recomputes each entry's hash from its stored fields and flags any that do not match, catching in-place edits as well as chain breaks.

Customers can:

View the full audit trail for any consent request from the app.
Export the audit trail as CSV or JSON, with per-entry hash-validity and chain-integrity status.
Download W3C Verifiable Credential receipts for approved decisions — signed with RS256 against a public key you can fetch.

Verifying a receipt yourself

Anyone with a Pactline receipt can verify it against our public keys — no account or insider access required.

Fetch the public JWKS at https://pactline.io/.well-known/jwks.json.
Verify the receipt JWT (in receipt.proof.jwt) using any RS256-capable library.
Or use the hosted endpoint: POST https://pactline.io/api/consent/verify-receipt with body {"jwt": "<the receipt JWT>"}. Response includes signer identity, algorithm, and issuance date.

Legacy receipts: receipts issued before Pactline switched to asymmetric signing carry an HS256 signature and cannot be independently verified. The verify endpoint acknowledges those with a legacy: true flag. New receipts are RS256 by default.

Compliance posture

Pactline is engineered to help teams meet human-oversight and evidence requirements in the following frameworks. Formal certifications are on the roadmap and we do not claim them until earned.

GDPR Ready. Data-subject export and deletion endpoints available; DPA available for signature.

EU AI Act Aligned with Article 14 human-oversight requirements for high-risk AI systems.

HIPAA Ready for HIPAA-adjacent workflows. BAA available for Enterprise contracts.

SOC 2 Type II On roadmap. Not yet certified. Contact us for current audit status.

ISO 27001 Under evaluation post-SOC 2.

Security disclosures

If you believe you have found a security issue in Pactline, please email security@pactline.io. We treat disclosures confidentially and will acknowledge receipt within one business day.

Please do not include exploit details in general support channels.

Data processing and legal

See our Privacy Policy, Terms of Service, and Data Processing Agreement for the formal documents.