Promtact

Security

Last reviewed 7 August 2026

This page states what is implemented, what is not, and how to report a problem. Where a control is built but not switched on, that is said rather than glossed over.

Not claimed: no SOC 2 or ISO 27001 certification, no third-party penetration test, no contractual uptime commitment. Anyone evaluating Promtact should weigh that alongside what follows.

Reporting a vulnerability

Use GitHub's private vulnerability reporting on the repository — Security → Report a vulnerability. That opens a private thread with the maintainer.

StageTarget
Acknowledgement3 business days
Triage and severity7 business days
Fix for critical or hightypically 14 days
Disclosurecoordinated with the reporter after a fix exists

Reporters are credited unless they prefer otherwise. Please allow a reasonable window before public disclosure. Full policy in SECURITY.md.

How it is built

Two direct dependencies. A Postgres driver and a SAML library. Distributed tracing, TOTP and encryption at rest are implemented against the standard library rather than by adding packages — the authentication path is where a compromised dependency is worth the most to an attacker.

Releases are signed with keyless signing, and each carries an SPDX software bill of materials. Verification steps are in SECURITY.md.

Controls are pinned by tests that state the failure they prevent, not just the behaviour they expect. A benign ATT&CK-mapped validation suite runs hourly against the live deployment and alerts if any verdict changes.

Access control

Authorisation is central rather than per-handler, so a new endpoint cannot forget its own check. The tenant comes from the calling credential and is part of the database query, so another customer's record identifier resolves to not found instead of confirming that it exists. Identity is resolved on every request, so a revoked key stops working on the next call.

Agents authenticate as service accounts and can never hold an interactive session, which is what makes a second factor enforceable for people without breaking any agent.

The provider's own access

This is the part worth reading closely, because it is the part most providers leave out.

Direct database access by the operator is announced before it is taken; the announcement enters the tamper-evident audit chain and is published to a witness outside the host. It is observed independently through the database's own connection log, by a component whose credential can do nothing but report. The two are reconciled: a session with no announcement covering it becomes an audit record and an alert.

The audit chain's head is published to that external witness, which refuses a chain that got shorter and refuses a different head for an index it already recorded. An operator with root can rewrite local history; they cannot make the witness agree.

The limit, stated: none of this prevents an operator from reading data. On a single host with one root user, nothing can. It makes reading attributable and erasure detectable, and the claim goes no further.

Reading further

Technical claimsEach claim with the command that checks it
Threat modelWhat it defends against, and what it does not
Access controlWho can reach customer data, and what is recorded
Incident responseSeverity, notification deadlines, recovery
Design decisionsWhy it is built this way, including what was rejected