Your data is safe here.
Security is not a feature we bolt on — it's how the product is built. Here's what we do to protect your agency's data.
Encryption
All data is encrypted in transit with TLS 1.3 and at rest with AES-256. Backups are encrypted as well, and keys are managed separately from the data they protect.
Authentication
Every team member authenticates individually — no shared logins. Role-based permissions (owner, admin, manager, member) control exactly what each person can see and do.
Workspace isolation
Each workspace is an isolated environment. Clients, retainers, time and reports never leak between workspaces, and access is scoped at the workspace level.
Infrastructure
We run on managed cloud infrastructure with automatic patching, monitored access, encrypted storage and regional data residency. Access to production is limited and audited.
Responsible disclosure
If you find a security issue, tell us first. Report it to us privately, give us a reasonable window to fix it before any public disclosure, and we'll credit you in our acknowledgements.
SOC 2 Type II
Coming soonWe're working toward SOC 2 Type II attestation and will share our report with customers as soon as it's available. Until then, we're happy to answer any questions directly.
Reporting a vulnerability
Found a security issue? Please report it privately to hello@pace.so with the subject line "Security report." We'll acknowledge it promptly, keep you updated on the fix, and never pursue legal action against good-faith researchers.
More detail is available in our Data Processing Agreement.