Security & Trust
Pace is a multi-tenant business cloud. This page summarizes how we protect customer data. For privacy rights, see our Privacy Policy.
Encryption in transit
TLS terminates at Cloudflare (edge) and Traefik (execution plane). All public endpoints use HTTPS. Internal service traffic runs on private Docker networks.
Encryption at rest
Supabase Postgres uses managed encryption at rest. Object storage and backups inherit encryption from the underlying provider.
Multi-tenant isolation
Every tenant-scoped database query runs with Postgres row-level security (RLS). Strut sets app.current_tenant_id on each connection before application SQL executes. Cross-tenant reads are blocked at the database layer.
Authentication
Human login uses Stytch B2B (RS256 JWTs). Relay validates tokens on every API request. Tenant workspaces use tenant-first hostnames ({tenant}.pacehq.io) so session cookies stay on one origin.
Audit log
Agent actions and security-sensitive events append to an audit log in Postgres. Production agents do not have a delete path for audit records.
Error monitoring
Application errors are sent to Sentry (pace-hq organization) with tenant tags where available. We do not log passwords or payment card numbers.
No shared credentials
Tenant data and service credentials are isolated. Operators do not reuse one tenant’s secrets for another.
Vulnerability disclosure
Report security issues responsibly to security@pacehq.io. Include steps to reproduce and impact. We aim to acknowledge reports within a few business days.
Status and incidents
Platform availability is published at status.pacehq.io.