Pacterms
PrivacyHome
Security

Built for trust

Your data is encrypted in transit and at rest, behind access controls. Security is not an afterthought; it’s built into everything we do.

Security Practices

  • All data encrypted in transit (TLS 1.3)
  • All data encrypted at rest (AES-256)
  • Two-factor authentication available
  • Once recorded, an event cannot be altered or removed — corrections are recorded as new events
  • The integrity of stored records is re-checked automatically on a recurring schedule
  • Dependency updates are monitored automatically and reviewed before merge
  • No independent third-party security audit has been performed yet
  • A security brief is available on request for reviewers who need more detail
  • Access logs and monitoring
  • As Pacterms grows, we plan to evaluate independent assurance programs appropriate to the scale and needs of the service.

Document Integrity & Verification

Pacterms is designed to preserve a checkable record of every released version: a fingerprint of its exact text, an independent timestamp, and a public way to confirm both. Nothing has been released yet, and the public verifier is designed, not built.

  • Every release record carries a SHA-256 fingerprint of the exact released text, computed and recorded the moment it is released.
  • That fingerprint is independently timestamped by a public RFC 3161 Timestamp Authority (DigiCert, with FreeTSA as a fallback): proof the text existed at that exact time, signed by a third party with no stake in the record.
  • Once the public verifier is built (it is designed, not built yet), anyone will be able to compare the published fingerprint to one they compute themselves, and download the raw timestamp token to check independently with standard open-source tools. No Pacterms account or software will be required.
  • A release requires the attorney’s verified login and a one-time code, and the code’s event is recorded on the release record.

Public verification, once built, will confirm whether a fingerprint matches the record and whether its timestamp token is valid. It does not determine legal enforceability, or decide the outcome of a dispute.

How the record stays checkable

Here is exactly what happens when a version is released. No black box: a fingerprint, an outside timestamp, and a public page, designed and not yet built, where anyone will be able to check both.

  1. 1

    Fingerprinted (SHA-256)

    The instant a version is released, we compute a unique 64-character fingerprint of its exact text. Change one character and the fingerprint changes completely.

  2. 2

    Independently timestamped (RFC 3161)

    That fingerprint, never the text itself, is sent to an outside Timestamp Authority under the RFC 3161 standard. It signs and returns proof of the exact moment. If no timestamp can be obtained, the release does not happen.

  3. 3

    Designed to be verifiable by anyone, no account required

    The public verifier is designed, not built. Once it is, every released version will get its own public verification page, with no login required, and anyone will be able to confirm the fingerprint and timestamp independently of Pacterms, using the same open standard.

Infrastructure in use
DigiCert TSAFreeTSA fallbackSHA-256RFC 3161StripeTelnyx SMSToll-free SMS verified

Report a Concern

Found a security issue? We take reports seriously.

Email: security@pacterms.com

Reports are read directly by the founder. We do not offer a guaranteed response time.

We work with security researchers and offer recognition (and rewards for valid vulnerabilities once we have funding).