Security at Pathfix
Built to protect the connection between your application and your users' APIs.
Pathfix manages sensitive OAuth infrastructure on behalf of applications, including provider credentials, access tokens and refresh tokens. Security is built into how those connections are stored, accessed and operated.
Your OAuth apps. Your credentials. Your customer relationships.
Protected by infrastructure built for production use.
Your credentials and tokens stay protected
Pathfix handles the sensitive authentication material required to keep your users connected without requiring your application to manage OAuth tokens itself.
Encrypted at rest and in transit
Sensitive data is encrypted both at rest and in transit using industry-standard encryption. Specific cryptographic implementation details are not publicly disclosed.
Provider credentials protected
Provider OAuth credentials are encrypted before being stored and are not stored in plaintext.
Encrypted backups
Database backups containing protected data are encrypted.
Restricted production access
Access to production systems and sensitive infrastructure is tightly restricted and protected by internal access controls and multi-factor authentication.
Your OAuth application stays yours
Pathfix doesn't put your users through a shared Pathfix OAuth application.
You configure your own provider Client ID, Client Secret and scopes. When users authorize access, they're connecting to your application.
Pathfix handles authentication, not your application data
Pathfix is designed as authentication infrastructure, not as a destination for the data your application retrieves from connected services.
When your application makes an authenticated provider API request through Pathfix, Pathfix identifies the appropriate user connection, authenticates the request and passes the provider response back to your application.
Pathfix stores what is required to maintain authenticated connections, rather than maintaining a copy of the application data you're building with.
Control where requests come from
Pathfix provides application-level controls to restrict where requests to your integration can originate.
Requests that don't satisfy the configured restrictions can be rejected before reaching the provider API.
IP restrictions
Restrict server-side requests to approved IP addresses.
Origin restrictions
Configure authorized origins for supported browser-based requests.
Infrastructure built for availability and resilience
Pathfix infrastructure operates across Microsoft Azure and Google Cloud.
Production systems are backed up regularly, with database backups encrypted to protect stored information.
Continuously monitored for vulnerabilities
Automated vulnerability monitoring
Pathfix uses automated systems to identify vulnerabilities and dependency-related security issues so they can be reviewed and addressed.
Independent security testing
Pathfix engages third-party security professionals to perform penetration testing of its infrastructure.
Operational data doesn't stay forever
Operational activity and transactional monitoring data is retained only for the period required for monitoring and troubleshooting.
Monitoring and transactional logs are automatically purged after 30 days.
This applies to logs. It does not apply to the credentials and tokens required to keep an active connection working.
Built and operated for production
Pathfix has operated production OAuth infrastructure since January 2020 across code, no-code and AI-built applications.