Pactora
Log In

Pactora Beta

Security

How Pactora protects uploaded contracts, derived outputs, and account data across its AI-powered contract review pipeline.

Effective date: 7 March 2026

Last updated: 14 September 2026

At a glance

  • —Data is encrypted in transit (HTTPS/TLS) and at rest (AES-256 via Supabase and Vercel).
  • —Accounts use secure cookie-based sessions backed by Supabase; Google OAuth is supported.
  • —Uploaded documents are processed by Anthropic's API under API-mode data handling terms — not used for public model training.
  • —AI-flagged clauses are verified against the source document before being returned; free-text AI output is structurally constrained.
  • —A deterministic integrity engine runs separately from the AI pipeline with no LLM involvement.
  • —Pactora is in beta — pragmatic controls, not enterprise certification. This page is kept current as the posture evolves.

1. What this page covers

Pactora is an AI-powered contract review and decision-support service. It processes uploaded contracts — PDF and DOCX — to extract terms, flag clauses, run structural integrity checks, and generate suggested redlines. This page describes the technical and organisational controls applied across that workflow to protect uploaded documents, derived outputs, and account data.

2. Encryption in transit

All data exchanged between your browser and Pactora is encrypted in transit using HTTPS/TLS, enforced at the network edge by Vercel. Connections to Supabase (authentication and storage) and Anthropic (AI processing) are also encrypted in transit.

3. Encryption at rest

Data stored by Pactora — including document metadata, account records, and session data — is encrypted at rest by Supabase and Vercel, which manage encryption keys on our behalf using industry-standard AES-256 or equivalent. Pactora does not hold raw storage encryption keys directly.

4. Authentication and session security

Accounts are authenticated through Supabase-backed sessions. Google OAuth is available as a sign-in method. Sessions are managed using secure, HttpOnly cookies. Access tokens are refreshed server-side; Pactora does not expose long-lived credentials to the browser. The service is intentionally limited to authenticated users for document upload and analysis.

5. How uploaded documents are handled

Uploaded agreements are treated as confidential business information. On upload, document text is extracted server-side (PDF via pdf-parse; DOCX via mammoth) and the structured text is sent to Anthropic for analysis. The document text is included in the first system block of each AI request, with a cache_control header that enables prompt caching — this means repeated parallel requests for the same document pay a reduced cost but the document text is not stored persistently by Anthropic beyond its standard data handling terms. Customers remain responsible for assessing what they upload and for ensuring they have authority to share the document with a third-party AI service.

6. AI processing and data handling

AI analysis is provided by Anthropic (Claude models). Pactora sends extracted document text and structured prompts to Anthropic's API to identify and flag clauses. Pactora does not use customer content to train public foundation models. Anthropic's own data handling and API policies apply to content processed through their API; Pactora uses API-mode access, which carries different data handling terms from consumer products. See the Subprocessors page for further detail.

7. AI output integrity

To reduce hallucination risk, every clause flagged by an AI agent is verified against the full source document text before being returned. Clause text that cannot be located in the source is discarded. AI agents are constrained to structured tool-use outputs (flag_clause or no_issue_found) rather than free text, which reduces the surface area for model-generated inaccuracy. A deterministic integrity engine runs separately from the AI pipeline and applies no LLM processing.

8. Access controls

Operational access to Pactora's infrastructure is restricted to authorised personnel with role-appropriate permissions. Pactora applies least-privilege access principles across internal systems. Operator-level endpoints are protected by a separate operator key. Infrastructure provider consoles (Vercel, Supabase, Anthropic) are accessed through their respective identity and access management controls.

9. Analytics and cookies

Pactora uses essential cookies for login sessions and CSRF protection; these are strictly necessary and set without consent. Analytics cookies (Google Analytics, PostHog) are loaded only when you explicitly accept them. Vercel Web Analytics counts page views without cookies and without advertising use. No data collected through analytics is used for advertising purposes.

10. Monitoring and incident response

Pactora uses operational logs and monitoring across the hosting stack and application layer to detect abuse, investigate anomalies, support availability, and respond to security events. Logs are retained for a limited period consistent with operational and legal requirements. In the event of a security incident affecting your data, Pactora will notify affected users and relevant authorities as required by applicable law.

11. Subprocessors

Pactora relies on third-party infrastructure providers to operate the service. Current providers include Anthropic (AI processing), Vercel (hosting and web delivery), Supabase (database and storage), Resend (transactional email), Google (OAuth authentication and optional analytics), and PostHog (optional analytics). Their security controls form part of Pactora's overall security posture. Full details are on the Subprocessors page.

12. Beta security posture

Pactora is in active beta. The service is not positioned as an enterprise-certified or SOC 2-audited platform at this stage. Controls are pragmatic and evolving. Pactora prioritises clear disclosure over certification claims and will update this page as the security posture develops.

13. Vulnerability disclosure

If you discover a security vulnerability in Pactora, please report it responsibly to help@pactora.uk with a description of the issue and, where possible, steps to reproduce. Pactora will acknowledge receipt, investigate, and respond. Please do not disclose vulnerabilities publicly until Pactora has had a reasonable opportunity to investigate and remediate.

14. Security contact

For security questions, vulnerability reports, or data security concerns, contact help@pactora.uk.

Related pages: Terms · Privacy · Subprocessors

We use essential cookies to keep you signed in. We would also like to use analytics cookies to understand how the product is used. You can decline without losing any functionality. Privacy policy