Trust & Compliance

Security at Pactora

We handle some of the most sensitive documents in your practice. That responsibility shapes every architecture decision we make.

Built for Legal-Grade Confidentiality

Pactora is engineered from the ground up to meet the stringent security and confidentiality requirements of legal professionals. We understand that trust is non-negotiable. Your client data is treated with the same duty of care you owe your own clients.

Encryption at Rest & In Transit

All data is encrypted using AES-256 at rest and TLS 1.3 in transit. Your contracts and playbooks never travel unprotected.

Zero-Training Data Policy

Your documents are never used to train, fine-tune, or improve our AI models. Your data remains yours exclusively.

Tenant Isolation

Every workspace is logically isolated. Your contracts, playbooks, and analysis results are never co-mingled with another organization.

Full Audit Logging

Every access event, analysis run, and data export is logged with timestamps and user attribution for full compliance traceability.

Automated Data Retention

You control your data lifecycle. Uploaded documents can be deleted on-demand. Deleted data is permanently purged within 30 days.

Role-Based Access Control

Granular permissions ensure only authorised team members can access, review, or export sensitive contract analysis and playbook data.

Infrastructure & Compliance

Cloud Infrastructure

Hosted on enterprise-grade cloud providers with SOC 2 certified data centres and 99.9% uptime SLAs.

Vulnerability Management

Continuous vulnerability scanning, dependency auditing, and timely patch management across all services.

Incident Response

Documented incident response procedures with defined escalation paths and mandatory breach notification within 72 hours.

Responsible Disclosure

If you believe you have discovered a security vulnerability in Pactora, please report it responsibly to security@pactora.in. We take all reports seriously and will acknowledge receipt within 24 hours. We request that you do not publicly disclose vulnerabilities until we have had a reasonable opportunity to investigate and remediate.

Last updated: April 2026