Version 2026.08.06 ยท Effective 2026-08-06
Security Policy
1. Overview
This Security Policy describes administrative, technical, and organizational measures Pamphlet Inc. uses to protect the Services and Customer Content. It supports the Data Processing Addendum and Trust Center materials at /trust.
2. Access control
Access to production systems is limited to authorized personnel with a business need. Customer workspace access is enforced through Clerk authentication, organization membership, and role-based permissions within Pam Pods.
API access requires Bearer tokens using pam_ prefixed keys. Keys are stored as SHA-256 hashes, scoped to a single Pam Pod, revocable, and may have optional expiration.
3. Tenant isolation
Pam Pod data is isolated at the application layer and enforced in the database through Supabase row-level security policies. Cross-tenant access is denied by policy. Application code validates pod_id on data access paths.
4. Encryption
Data in transit is protected with TLS. Infrastructure providers encrypt data at rest. Connector credentials and model provider API keys are encrypted at the application layer using AES-256-GCM with dedicated encryption keys.
Webhook payloads can be verified using HMAC SHA-256 signatures via the X-Pamphlet-Signature header.
5. Logging and audit
Pamphlet maintains append-only audit events for security-sensitive actions, authentication events, and API activity appropriate to the feature. Logs support incident investigation and customer accountability.
6. Application security
Pamphlet deploys security headers including Strict-Transport-Security, Content-Security-Policy, X-Frame-Options DENY, Cross-Origin-Opener-Policy, and Cross-Origin-Resource-Policy. Open redirect targets are restricted to approved Pamphlet domains. User-supplied HTML fragments are sanitized before rendering.
7. Vulnerability management
Pamphlet reviews reported vulnerabilities and prioritizes remediation by severity. Security researchers and customers may report issues to cs@pamphlet.io. Pamphlet does not operate a public bug bounty program unless separately announced.
8. Incident response
Pamphlet maintains procedures to detect, contain, and remediate security incidents. Confirmed Personal Data breaches affecting Customer Pam Pod data are handled per the DPA notification requirements.
9. Certifications and attestations
Pamphlet publishes only security and compliance claims that are verified and documented in the Trust Center. Pamphlet does not claim SOC 2 Type II, ISO 27001, HIPAA compliance, or GDPR certification unless and until such claims are verified and published with supporting evidence.
10. Customer responsibilities
Customers must protect account credentials, rotate compromised API keys, configure least-privilege roles, and use BYOK credentials securely. Customers are responsible for security of data exported from the Services and for third-party connectors configured with their credentials.
11. Contact
Security inquiries and vulnerability reports: cs@pamphlet.io