Home › Security
Security, on one page
How Pact protects your staff files and program records. Each point here is in Pact's portal privacy notice or service agreement.
Where it's kept
- Hosted in the United States on Amazon Web Services, under Pact's control.
- The database is encrypted at rest, and connections are encrypted in transit.
- Dates of birth, driver's license (CDL) numbers, and residents' names and EHR ID numbers are encrypted again inside the database.
Who can sign in and see it
- Your admins and the staff you authorize. Two-step sign-in for every client login and every Pact user, and automatic sign-out after inactivity.
- Pact staff, only to run your program.
- Anyone you choose to give a packet to, such as a surveyor. Anyone else only as the law requires.
- Staff open their own page from a link and see only their own list.
Every view is logged
The portal keeps a log of who viewed or changed what, and when. Every view of a worker's records is recorded.
What the automated reader sees, and what it never sees
- An automated system reads each upload; a Pact reviewer confirms it. The system is Anthropic's. It reads credential documents, such as a license, TB result or CPR card, and its terms don't let it train its models on what it reads. It never approves anything on its own.
- Test results, drug screens and background check reports are never sent to it.
- An email to support that could mention a test result, medical or legal details is never sent to it.
If something goes wrong
- Pact notifies you in writing without undue delay, the same business day as a practice, and within 72 hours at most.
- Within five business days after that, you get the dates, what happened, the kinds of information involved, how many people were affected and the steps taken.
- You decide whether and how your staff are notified. Pact doesn't notify individuals, regulators or the media about your data without your written approval, unless the law requires it.
What Pact never does
- Never sells your information, and never uses it for marketing.
- Never receives Social Security numbers for background checks: the person being checked enters their own on the screening company's site.
Your records are yours
- View or download copies any time in the portal.
- At any time, including when you leave, Pact gives you or your new provider all of your records at no charge.
- A healthcare employer's records are kept while it uses Pact and given to it when it leaves.
HIPAA
Staff records you keep as an employer are employment records, not protected health information (45 CFR 160.103). Pact doesn't provide medical care. Staff records stay employment records. For resident immunization records, Pact is your business associate and signs a BAA with your home before the first resident is added. Resident records are encrypted, every view is logged, they never go to AI tools, and emails never name a resident.
Questions
Security: security@pactcompliance.com · Privacy: privacy@pactcompliance.com · 901-666-6970. Pact follows up by email the same business day.
Read the full portal privacy notice, the website privacy notice and the portal terms. Updated October 21, 2026.