In short
- Passwords are hashed, every connection uses HTTPS, and admin rights apply only to the workspace someone administers.
- Every approval, role change and removal goes in an audit log.
- Hosting is on Vercel; data lives in MongoDB Atlas. We don't sell data.
- SSO, a SOC 2 report and a DPA aren't available yet. We say so plainly below.
What's in place today
- Hashed passwords. Passwords are stored only as bcrypt hashes. Changing your password signs out your other sessions, and logging out ends every session for that account.
- HTTPS everywhere. The website, app and API are served over HTTPS.
- Per-workspace admin roles. The roles are Enterprise admin, Team member and Vendor. Admin rights apply only to the workspace a person administers, joining with a code never makes anyone an admin, and every workspace must keep at least one admin.
- Vendors kept at arm's length. A vendor only reaches workspaces that approved it, and sees only the names of the people in its own deals: no directory, posts or chat.
- Audit log. Approvals, role changes, removals and other admin actions are recorded with who did them and when.
- Abuse limits. Sign-in and public forms are rate limited. Uploaded images are limited in size.
- Joining controls. Admins can invite by email or link, allow a company email domain, and require approval before new people get in.
Your data
We collect what's needed to run a workspace: name, work email, department, office, activity in the workspace and the credits ledger. The Privacy notice lists it in full.
- Team members see names, departments and bios.
- Enterprise admins also see emails and contact details.
- Vendors see only the names of people in their deals.
During the pilot, credits are a budgeting tool, not money, and Pasaq doesn't store payment card details.
Hosting
The website and API run on Vercel. Data, including uploaded images, is stored in MongoDB Atlas. Both providers process data on our behalf to run the service.
Deletion and retention
- Members can delete their account from their profile. That removes their profile, posts, messages, activity records and credits ledger.
- Enterprise admins can remove people from their workspace.
- We keep data while an account is open. At the end of a pilot, a company can ask us to delete its workspace.
- We don't sell personal data.
What isn't there yet
We'd rather be clear than impressive. Pasaq is in its pilot stage, and today it does not have:
- Single sign-on (SSO) through SAML or OIDC. People sign in with an email and password.
- A SOC 2 report or any other security certification. We don't claim one.
- A signed data processing agreement (DPA).
We plan to offer SSO, SOC 2 and a DPA on request in the future. If your company needs any of them for a pilot, tell us through the contact form and we'll tell you honestly where they stand.
Report a security issue
If you think you've found a vulnerability, please tell us through the contact form with "security" in the message, and don't access other people's data while testing. We'll reply and keep you posted on the fix.