InfinityOre · version 2026-09-26
Security
Status of this text. It describes how the product actually behaves during its pilot stage. It has not yet been reviewed by a lawyer, and the operator details below may be incomplete. Nothing here is legal advice. The operator’s registered legal name and address have not been set on this deployment.
What PactMeter does to protect an account and its data, and, as importantly, what it does not claim. It has not had an independent security audit or certification, and this page does not promise any.
1. Accounts
- Passwords are stored only as salted scrypt hashes; the password itself is never stored or logged.
- Sessions use a random token in an HttpOnly, SameSite cookie (Secure and host-locked in production); the server keeps only a hash of it. You can see every signed-in device and sign any of them out, or all of them.
- Google sign-in verifies Google’s signed identity token on the server (signature, issuer, expiry and that it was issued for this site); the browser’s claim alone is never trusted.
- Email confirmation, password reset and change of password use single-use, time-limited links; a reset ends every session. Reset requests say the same thing whether or not the address has an account.
- Deleting an account or workspace, and linking Google, need a recent password confirmation.
- Sign-in and reset attempts are rate limited.
2. Your data
- Each workspace is isolated from others in the database, and access is decided on the server from your session, never from anything the browser sends.
- Uploaded documents are treated as untrusted data: they are parsed as text or tables and never executed, and text inside them cannot give instructions to the system.
- Amounts, dates and deadlines are computed by deterministic code and can be reproduced from stored inputs. A language model, when enabled with your consent, only helps read text; its output is validated and never decides money.
- Every automated action is recorded with who or what did it, under which policy version, on what evidence and with what result. The record is append-only.
3. What is not in place
- No third-party penetration test, SOC 2 or ISO 27001 report exists.
- Multi-factor authentication and single sign-on other than Google are not offered.
- Backups, encryption at rest and network controls depend on where the operator hosts the database; they are not something the software itself provides.
4. Reporting a problem
The contact address for security reports has not yet been set on this deployment.
Related: Terms of service · Privacy policy · Fees and refunds · Cookies · Security · Acceptable use · Subprocessors · Contact