PairRail Atlas handles seller commercial data and authentication for a multi-protocol agent-readiness control plane. We take security seriously and welcome good-faith research that helps keep sellers and buyers safe. For how Atlas keeps agents inside your limits and your pricing private, see the Security overview.
Security posture (high level)
- Transport. HTTPS for pairrail.com; DNS, CDN and edge protections via Cloudflare where configured.
- Separation of concerns. Public protocol endpoints serve published commercial projections; console and admin APIs require authentication and role checks.
- Enterprise controls. A dedicated database with row-level security (Cloud SQL), customer-managed keys (Cloud KMS), SSO and data residency are not available today. If an Enterprise contract needs one, it is scoped in your order form.
This page is not a warranty or audit certification. We do not currently publish a SOC 2 report or a pentest letter. Controls evolve as the product matures.
Where Customer Content lives
- Catalog and workspace state. Live data is stored in Cloudflare R2 and D1 in Cloudflare's Asia-Pacific region, read and written by Cloud Run in
us-central1(United States). Cloudflare keeps recent saved versions of it. - Sign-in. Firebase Authentication (Google, GitHub, or email code).
- Extraction. When you run AI extraction or Deep verification, Claude runs it through the Anthropic API. If Claude is unavailable, Gemini on Google Cloud Vertex AI runs it. Backup models are listed on Subprocessors.
- Edge telemetry and feedback. Cloudflare D1 and R2, for reliability and abuse detection. It covers seller users and protocol usage, not operator product actions.
- Atlas subscription billing. Dodo Payments. We store entitlement metadata, not card numbers.
- Mail. Resend for transactional messages.
- Connectors you enable. Stripe, Chargebee, HubSpot, or your webhook, using tokens you save. See Subprocessors.
Access control
- Seller console access requires an authenticated workspace user and role checks. Roles gate publishing, pausing, machine keys, invites and billing.
- Published protocol surfaces serve only what you published. Acting on a catalog requires a seller-approved machine credential.
- Agent secrets (
pat_…) are shown once at issue, approve, or rotate. We do not re-display plaintext secrets later. - Integration tokens are stored for the workspace that saved them and used only to call that connector.
Backup and offboard
Live catalog state is kept in Cloudflare (R2 and D1), which keeps recent saved versions of it. Every write is also checked before it is saved: a change that would remove a seller’s workspace, catalog versions, agent keys or people is refused unless it comes from a deletion the owner confirmed, and even then only after a 14-day grace period. Edge telemetry is operational, not the system of record for prices.
Owners delete a workspace, and teammates delete their own account, in Workspace → Settings, where both can also download their data. Details sit in the Data Processing Terms.
Retention
Audit history is kept for 14 days on Sandbox, 90 days on Pro and 2 years on Enterprise. Catalog versions are kept while your workspace exists.
Incident response
Report suspected incidents and vulnerabilities to security@pairrail.com. We acknowledge when practicable, prioritize by severity, and notify affected customers when a fix is deployed if you gave us a valid contact. Production-blocking issues should also go to support@pairrail.com with subject P1.
Responsible disclosure
If you believe you have found a vulnerability in PairRail Atlas or pairrail.com, please email security@pairrail.com with the subject line Security disclosure. support@pairrail.com still reaches us if the security mailbox is unavailable.
Include:
- A clear description of the issue and potential impact.
- Steps to reproduce (proof-of-concept limited to what is necessary).
- Affected URLs, endpoints, or console flows.
- Your contact information and preferred credit name (optional).
Please do
- Give us a reasonable time to investigate and remediate before public disclosure.
- Limit testing to accounts and data you own or are authorized to use.
- Avoid privacy violations, data exfiltration beyond proof, and service disruption.
Please do not
- Access, modify, or delete other customers’ catalogs, pricing, or evidence.
- Execute denial-of-service, social engineering of PairRail staff or customers, or physical attacks.
- Introduce malware or ransomware.
- Publicly disclose exploit details before we confirm a fix or mutually agree on timing.
Scope notes
In scope: pairrail.com application surfaces you reasonably believe we operate (console, APIs, protocol endpoints, edge telemetry/feedback paths). Out of scope unless we say otherwise: third-party services (Firebase, Google, GitHub, Cloudflare, payment providers), which you should report to the respective vendor; misconfigured personal forks; and issues requiring unlikely user interaction with no security impact.
Our commitment
We will acknowledge receipt when practicable, prioritize based on severity, and notify you when a fix is deployed when you provide a valid contact. We will not pursue legal action against researchers who comply with this policy in good faith.
We do not currently operate a paid bug bounty. Recognition may be offered at our discretion.
Contact
security@pairrail.com · Subject: Security disclosure
Related: Subprocessors · Data Processing Terms · Support hours