Trust
How PaxExact handles your data
No compliance certifications exist for PaxExact today, and this page won't claim any. What follows is exactly how data is handled today, as built.
Organization-scoped isolation
LIVEYour estimates, evidence, and prices are scoped to your organization. Cross-organization access returns not-found, never a hint that the data exists.
API keys are stored only as verifiers
A developer API key's secret is shown once, at issuance or rotation. PaxExact stores only a SHA-256 verifier and cannot show it again.
Request bodies are never logged
Usage records for the developer API hold the key id, route, status, and timing — never the contents of what you sent.
Your prices stay private
Prices you enter stay private to your organization and don't inform other customers' pricing suggestions unless you explicitly opt in.
A human approves every scope
LIVEA scope cannot become a priced, reportable estimate without an explicit approval step by a professional — enforced in code, not policy.
What we don't claim
No certifications, no reviews
PaxExact does not hold SOC 2, ISO 27001, HIPAA, or any other compliance certification today. If that changes, it will be published here with a link to the actual attestation — never asserted without one.