Trust Center

The same posture we sell. Observed live, not asserted in a PDF.

Pactward operates under the same continuous-monitoring discipline we ship to customers. The Trust Center below describes what we cover, where evidence lives, how access is gated, and how to reach us if you find something we should look at.

Talk to the Pactward teamJump to framework coverage
SOC 2 + ISO 27001 aligned
Read-only by default
Evidence compounds nightly

Frameworks covered

Five anchor frameworks — mapped, cross-mapped, observed.

Each framework is owned by the platform, not by a one-off spreadsheet. Find a SOC 2 access drift and the same finding resolves against HIPAA §164.312, ISO 27001 A.9, the GDPR records-of-processing inventory, and your PCI scope — each one recorded in the same audit trail.

SOC 2 Type II
Covered
Observes the Trust Services Criteria (CC1–CC9) on every connector scan, with auto-remediated evidence bound to each finding.
ISO 27001
Covered
Annex A controls cross-mapped from live cloud and identity posture — no manual evidence-collection spreadsheet.
GDPR
Covered
Data lineage, retention rules, and cross-border transfer checks run continuously against your real data flows.
HIPAA
Covered
Administrative, technical, and physical safeguards §164.308 / §164.312 / §164.310 watched end-to-end.
PCI DSS
Covered
Cardholder data environment segmentation, access control, and audit-log integrity monitored on a continuous cadence.
SOC 2 Type II roadmap

Observation window in progress

Pactward operates under a SOC 2 Type I report today. Our Type II observation window opened in Q2 and runs across a full twelve months of production traffic. The Type II report is on track for issuance in Q2 of the following calendar year, after which it refreshes annually with no gaps in coverage. The current Type I report is available on request.

Roadmap milestones
The next twelve months, observed in production traffic.
  1. SOC 2 Type I reportIn market today
    Done
  2. Type II observation window12-month production window in progress
    Active
  3. Type II report issuanceOn track — Q2 next calendar year
    Planned
  4. Annual refresh cadenceContinuous coverage after issuance
    Planned
Encryption

Encryption at rest and in transit.

Customer data is wrapped in envelope-encrypted, KMS-managed keys the moment it lands on the platform. Keys never sit alongside the data they protect and are rotated on a quarterly cadence by default.

In transit
All customer traffic terminates TLS 1.3 with strict HSTS and modern cipher suites; service-to-service calls use mutually authenticated mTLS where they cross trust boundaries.
At rest
Primary databases are encrypted with AES-256-GCM using envelope encryption — KMS-managed data keys rotated on a quarterly cadence, never persisted alongside the data they protect. Backups, snapshots, and object-store copies inherit the same keying scheme.
Key management
Master keys live in a FIPS 140-2 Level 3 HSM. Access to decrypt customer data requires a quorum of operators from a separate, named break-glass group with time-bound approval and a recorded audit trail.
Data residency

Data residency

By default, customer data is processed and stored in the United States (US-East). For teams that require processing in the EU, the platform can be deployed to Frankfurt (EU-Central) as a region-pinned tenant. Cross-border replication is opt-in per data class and recorded in the data-flow graph.

Region coverage
Add yours
New regions light up by request — most customers go live with the default.
  • US
    US-East (default)Primary + failover
  • EU
    EU-Central (Frankfurt)Region-pinned tenant for EU workloads
  • +
    APAC + LatAmAvailable on request through your account team
Access controls

Access controls

Production access is gated by role-based controls enforced through the same auth module shipped to every customer. Interactive console access requires SSO + hardware-backed MFA + just-in-time elevation with an expiring ticket. Long-lived admin credentials are not issued; service-to-service credentials are scoped to a single workload and rotated weekly.

RBAC across dashboard, API, and connectors, with least-privilege defaults
requireAuth() gates every per-user /api route; requireAdmin() gates the health board and evidence packs
Quarterly access reviews surfacing orphan identities and stale grants
Privileged access recorded to an immutable audit log

Audit retention

Every action, recorded.

Every platform action — connector reads, scan triggers, ticket dispatches, find/login events, configuration changes — is recorded to a tamper-evident audit log. Logs are replicated across two regions for the first twelve months and retained in cold storage for seven years to satisfy auditor expectations on evidence compounding.

Hot window12 monthsMulti-region, queryable
Cold window7 yearsTamper-evident storage
Report an issue

Reporting a security issue

Responsible disclosure is welcomed. Report a vulnerability or suspected incident to the security team and you will receive an acknowledgement within one business day, with triage updates on a regular cadence until resolution.

Reach the security team atpactward-4@polsia.app

PGP fingerprint and disclosure scope available on request. Responsible disclosure is welcomed — there are no gag clauses in our process.

Security pack

Get the full document set, on a one-business-day turnaround.

Send through the form below under a mutual NDA and we will return the SOC 2 Type I report, ISO 27001 statement of applicability, latest penetration-test summary, and the sub-processor list.

Security pack request

Request our security pack

The pack includes our latest SOC 2 Type I report, ISO 27001 statement of applicability, penetration-test executive summary, data-flow diagram, and the sub-processor list. We respond with the full set within one business day under a mutual NDA.

  • Signed NDA available on request — turnaround under 24 hours.
  • Penetration-test scope and fixes-summary shareable after NDA.
  • Data-flow + sub-processor list accompanies the report set.