Trust

What a security or privacy reviewer usually asks about Pathbound, answered in one place. Everything on this page describes what is in place today. Nothing here is a plan.

1. Where we stand

• Audits and certifications—none. We have not had a SOC 2 or ISO 27001 audit, and no third party has tested our security, so there is no report to send. What we can show instead is this page, the Data Processing Agreement, and our answers to your questionnaire.
• Data processing agreement—our Data Processing Agreement is part of the Terms for every customer, with the EU Standard Contractual Clauses, the UK Addendum, and the Swiss amendments. It needs no signature, and we countersign a copy on request.
• Where data lives—in the United States, on one cloud server at Hetzner in Hillsboro, Oregon, with the database on an encrypted volume. Backups are encrypted, and a copy is stored with Cloudflare. We are not certified under the EU-US Data Privacy Framework; transfers from the EEA, the UK, and Switzerland are covered by the clauses in the Data Processing Agreement.
• Who can reach it—Pathbound is operated by its founder. Nobody else has access to production.
• Signing in—every user needs a second factor, an authenticator app or a passkey. API keys are separate credentials with their own scopes, and the second factor does not apply to them.
• AI—Pathbound has no models of its own, sends customer data to no AI provider, and never uses it to train models. The AI clients you connect read your data through our API under your own account with their provider.
• If something goes wrong—affected customers hear from us within 72 hours.
• When you leave—your data is deleted within 30 days.

2. What we hold

Pathbound keeps a synced copy of the customer data you connect: contacts and companies from your CRM and other tools; the emails, support conversations, and meeting transcripts attached to them; events from your website or app, if you install the Tracker; and rows from a database you connect. We process it on your instructions as your processor, and you remain its controller. Schedule 1 of the Data Processing Agreement lists the categories in full.

Pathbound is not built for health data under HIPAA, payment card numbers, or government-issued identification numbers of individuals, and the agreement asks you not to put them in.

3. What protects it

These are the measures in place today. The same list is Schedule 2 of the Data Processing Agreement, so it is a contractual statement, and it says so where something is not done.

• Encryption in transit—the app, the API, the MCP server, and the Tracker accept HTTPS only. Connections from Pathbound to the tools you connect use HTTPS. A connection to your own database uses TLS when you enable it on that connection.
• Encryption at rest—the database and the cache are stored on an encrypted disk volume, together with the export files a workspace admin generates, and the key to that volume is not stored on the server. The server’s swap space is encrypted. Database backups are encrypted as they are written, on our server and offsite, with a key that is not kept on the server either. In addition, OAuth tokens and API keys for connected tools, passwords for connected databases, and two-factor secrets are encrypted in the application with AES-256-GCM before they are stored. The server’s system disk, which holds the operating system and service logs, is not encrypted.
• Passwords and keys—account passwords are stored as salted bcrypt hashes; Pathbound API keys and password-reset tokens are stored only as hashes.
• Access to your workspace—every user needs a second factor, an authenticator app or a passkey (enforced from October 7, 2026). Sessions use cookies that scripts cannot read and that are never sent from another site. Roles (owner, admin, member) decide who may change workspace settings. API keys are limited by scope, and the scopes that send email, spend enrichment credits, or change streams have to be granted explicitly.
• Separation between customers—every database query is limited to the workspace of the authenticated user or key. A scripted test suite checks that one workspace cannot read or change another’s data.
• Access to production—administration is possible only over a private network, by SSH key. Password login is disabled, the SSH port is closed to the internet, and there is no web administration console. The database and the cache are not reachable from the internet, and each service connects to the database with its own credentials.
• People—Pathbound is operated by its founder. No other employee or contractor has access to production or to the data customers entrust to us.
• Logging—we log sign-ins, changes to authentication settings, and team changes, and every request made through the API or by an AI client: who made it, with which client or key, and when. A read of a contact, company, or deal through the API or an AI client, or of its conversations, meetings, or events, is also written to that record’s own access log.
• Data minimization—the Tracker replaces credential-like values and email addresses inside the page addresses, paths, referrers, and link targets it captures before they are stored; the page title, which it also sends, is stored as sent. You can exclude hosts, such as staging sites, from collection, and you can have the personal fields of contacts masked in what AI clients receive.
• Backups—a full copy of the production database is taken every day, encrypted, and stored with a second provider for 7 days. With a daily copy, a restore loses up to 24 hours of data. A backup that does not report within 26 hours raises an email alert. A full restore of a production backup from the second provider’s copy was last rehearsed on October 9, 2026, into a separate database instance with no network access.
• Vulnerabilities and changes—security updates to the operating system install automatically. Changes to the service go through version control, and only committed code can be deployed. We review its security ourselves and take reports at [email protected].

4. How we handle vulnerabilities

We learn of vulnerabilities from outside reports (our page on reporting a vulnerability says how to send one), from our own security reviews, and from advisories for the operating system and the libraries we build on. Each confirmed one is rated by what an attacker could reach with it, and fixed within a set time. We do not run a bug bounty program of any kind and do not pay for reports.

The clock starts when we confirm the problem. If a fix will take longer than its target, we put a mitigation in place first and tell whoever reported it. Security updates to the operating system install automatically; advisories for our dependencies are checked by hand.

5. How we handle incidents

A security incident is a breach of security that leads to the destruction, loss, or alteration of customer data that we or our sub-processors hold, or to its unauthorized disclosure or access. When we find one, we:

1. Contain it—cut off the access, rotate what was exposed, and keep the evidence.
2. Establish what was affected—which workspaces, which data, and over what period.
3. Notify—the owner and admins of every affected workspace, by email, without undue delay and within 72 hours of becoming aware. The notice says what happened, what data and how many people it concerns, the likely consequences, and what we have done. We add to it as we learn more.
4. Fix the cause—and keep a record of what happened and what we changed.

Outages and degraded service are published at status.pathbound.ai, which runs on separate infrastructure so that it stays up when we do not. The contractual terms are in Section 9 of the Data Processing Agreement.

6. The providers we rely on

These third parties process customer data for us. Before one of them handles your data, it is bound by a written agreement that protects it no less than our agreement with you does, and workspace owners and admins get 14 days’ notice before we add one. The full list says what data each one handles.

The tools you connect yourself, such as your CRM, your support desk, or the AI client you authorize, are your own providers and are not on this list.

7. Questions reviewers ask

Has a third party tested your security?

No. We test it ourselves: a full penetration test in July 2026 of the source code, the running service, and the server configuration, follow-up tests in August and September 2026, and a scripted test suite for separation between customers, authentication, and authorization.

Do you support single sign-on?

Sign-in with Google and with GitHub, next to email and password and passkeys, on every plan. We do not offer SAML or SCIM, and a workspace cannot restrict its members to one sign-in method.

How are passwords handled?

A password is 8 to 128 characters, with no rule about which characters. A reset goes only through a link emailed to the address on the account, and changing a password signs out every other session and every AI client that connected by signing in; an API key stays valid until it is revoked. We use no secret questions.

What does Pathbound staff do in our workspace?

When we work inside your workspace, to set something up or to answer a support request, we do it as a named member you invited, marked as Pathbound staff on your Team page, and each contact, company, or deal we open is written to that record’s access log; a list of records is not. Work on the production systems themselves, such as a migration or the investigation of a fault, happens outside the product and is not in that log.

How long do you keep data, and how is it deleted?

For as long as your workspace exists: Pathbound is a synced copy of your sources, so your records do not expire on their own. Export files are deleted after 7 days, device fingerprints 90 days after last use, and logs of deliveries and syncs after 30 to 90 days. When you ask in writing, or when you leave, we delete your workspace’s data within 30 days and confirm it in writing if you ask; backups that hold it expire within 7 more days. An admin can export the workspace’s records at any time.

Have you had a security incident?

No. There has been no breach of security that led to the destruction, loss, or alteration of customer data, or to unauthorized access to it or disclosure of it.

Are you GDPR and CCPA compliant?

We hold no privacy certification, and neither law requires one, so we describe what we do instead of claiming a label. For your data we are a processor under the GDPR and a service provider under the CCPA: we process it only on your instructions, do not sell it or use it for advertising, help with requests from the people it concerns, and delete it when you leave. The Data Processing Agreement makes those commitments contractual.

Will you fill in our security questionnaire?

Yes. Send it to [email protected]. Most of what it asks is answered on this page.

8. Documents

• Data Processing Agreement—print the page for a copy to sign; the signature block appears only on paper
• Sub-processors—who they are, what each one handles, and how we give notice of a change
• Privacy Policy and Terms of Service
• Reporting a vulnerability—where to write, what to expect from us, and what we do not permit
• Service status—availability now and past incidents

There is no SOC 2 report, ISO certificate, or third-party penetration test report to request: none exists.

Contact

Security questions and questionnaires go to [email protected]. Questions about the Data Processing Agreement and requests about personal data go to [email protected].