What we actually do, described plainly. We make no certification or compliance claims we have not completed.
Every record carries the organization it belongs to, and read and write rules are enforced in the database against your signed-in identity. There is no interface-only check that could be bypassed by calling the API directly.
Uploads go to a private storage area with no public URLs. A file is reachable only through a short-lived link issued to a signed-in member of the owning organization. Deleting an item deletes its files.
Document text is passed to a language model as data. The extraction step holds no tools, no secrets and no access to other organizations. Model output must satisfy a fixed schema and is rejected if it does not; it is then shown to you as a proposal, never applied automatically.
The assistant on this site answers only from curated public pages—product, pricing, FAQ and policies. It has no access to accounts, uploaded documents, support messages or administrative data, and it links to the page a statement came from.
Email and password sign-in with verification and password reset, plus Google sign-in. Sessions are held by the authentication service; administrative privilege is bound on the server and can never be granted by anything the browser claims.
Contact messages are stored in a private inbox with a status and internal notes. The address we notify is held in server configuration and never appears in this site's pages, scripts or responses.
Non-essential analytics run only with consent. Where a visit is recorded, the network address is derived on the server—never taken from a header a client can set—kept for at most 30 days, visible only to administrators, and then deleted automatically. Longer-term counts hold no network addresses. Approximate location is shown only when a trusted source provides it, and is otherwise left unknown.
We do not claim certification under any security standard, we do not claim a measured extraction accuracy rate, and we do not promise that using PactOrbit will prevent a missed deadline. It is a tool that surfaces dates; the decision remains yours.