Legal

Security

How PackAuth is built, and how to report a vulnerability.

Reporting a vulnerability

Email security@packauth.com. We acknowledge within 2 working days and keep you posted until it is closed.

• Please do not test against another tenant's data.
• Please give us 90 days before disclosing.
• We never pursue good-faith research that respects those two things.

How the system is built

Tenant isolation is structural, not a convention someone remembers. The database enforces it, and so does the build.

• Every query against a tenant table carries that tenant as a condition.
• Object storage is tenant-keyed. Tenants share no data plane.
• Audit rows and evidence snapshots are append-only at the database.
• CI attempts an update and a delete on every run to prove it.
• A signature is valid only for the scopes the signer holds.

The decision boundary

PackAuth does not decide admissibility itself. It assembles the facts, asks a separate decision engine, and enforces the answer.

• If that engine cannot be reached, PackAuth fails closed.
• No release is ever issued on an unanswered question.

What we have not done yet

PackAuth holds no external penetration test, and no SOC 2 or ISO 27001 audit. We say so because a security page implying certifications it does not hold is the first thing a serious buyer checks.

• Current status is available on request under NDA.