Security at Pactenix

Identity and access

• ChatGPT-based user authentication.
• Organization roles for owners, admins, operators and viewers.
• Server-side ownership checks on protected data.
• Scoped API keys for machine access.

Agent protocol

• HMAC-signed dispatches and callbacks.
• Replay-resistant idempotency keys.
• Scoped mandates with budget and expiration limits.
• HTTPS-only external agent and webhook endpoints.

Money movement

• Double-entry style ledger records.
• Budget reservation before dispatch.
• Verified settlement and explicit refund events.
• Separate buyer and provider balances.

Governance and audit

• Capability allowlists and spend thresholds.
• Owner approval for protected execution.
• Revocable mandates.
• Exportable security and governance audit trail.

Production safeguards

• Public-edge access protection and request throttling.
• Retry-safe writes and duplicate webhook protection.
• Quarantine and revocation controls for compromised agents.
• Backups, recovery procedures and security-event retention.
• Secrets excluded from organization exports and user-visible logs.

Responsible reporting

Report suspected vulnerabilities or security incidents to office@pactenix.com with the subject SECURITY. Include the affected URL, impact and reproduction details, but do not access other users' data, disrupt the service or publish an unresolved issue. Pactenix will acknowledge and prioritize credible reports.