Security and trust
What we can prove, and what we do not yet claim
This page is for the person who signs off on new tools. It states where your data lives, who processes it, what a person approves, and where our controls end.
Specifics a reviewer can check
Where your data lives
The site runs on Netlify. Its records are held in a Neon Postgres database provisioned for PatternSix alone — not a shared multi-tenant store. Traffic between a browser and the service is encrypted in transit.
Three named sub-processors
Personal data is processed by three providers and no others: Netlify for hosting and delivery, Neon for the managed database, and Resend for transactional email. Each receives only what its function requires, and the list is published rather than offered on request.
Consent enforced by category
Cookie consent is enforced by category. No analytics, advertising or cross-site tracking cookies are set — none at all. Our Cookie Policy sets out each category and what it covers.
What a person approves
AI colleagues draft copy, build triggers and schedule sends. A named human owner approves messaging templates, consent handling and any material change to journey logic before it goes live, and records what was sent, to whom and why.
The boundaries, stated plainly
This page is written for the reviewer who has to approve a new supplier. It states what is in place today and, where something a buyer expects is absent, it says so. PatternSix is pre-launch; we would rather you knew the limits than assumed them.
Where data lives, and who touches it
The website is hosted on Netlify, and its records sit in a single Neon Postgres database provisioned for this venture rather than pooled across tenants. Connections are encrypted in transit. Personal data is handled by three named sub-processors and no others — Netlify, Neon and Resend — each receiving only what its function requires: hosting and delivery, the database, and transactional email respectively. The full list is published, so you can review it before any conversation begins.
There is no signed-in product on this site
A security reviewer usually asks what a logged-in user can and cannot do. On this website the honest answer is that there is no authenticated product surface to describe: the site is public, and it holds no customer accounts to grant or revoke. The lifecycle programmes PatternSix operates run against your own email and product tooling, which remains your system of record; access there is governed by the terms we agree with you, not by a login here.
What runs automatically, and what a person signs off
AI colleagues carry out the operating work — drafting and revising copy, building and maintaining triggers, segmenting contacts and scheduling sends. They may iterate on send timing and content variants within templates already approved. They cannot change approved journey logic or consent rules on their own. A named human owner approves templates, consent handling and any material change before it is deployed, and holds the duty of care for what goes out. Suppression and consent state are enforced as a constraint checked before every send; no model judgement can override that check. Every send is recorded with what was sent, to whom and why, giving the human owner an auditable basis for oversight.
What we do not hold
Some things a mature vendor offers, we do not have, and we will not imply otherwise. PatternSix holds no SOC 2 or ISO 27001 certification and has commissioned no independent security audit or penetration test. We publish no uptime figure and make no availability commitment or service-level agreement. We run no bug-bounty programme and pay no reward for disclosure; what exists is a published disclosure route and a named human who owns the response. We integrate no analytics or usage tracking of any kind. These are absences we intend to close as the venture matures, not claims we are willing to fabricate now.
What you can ask for
A person can ask what personal data we hold about them, ask for it to be corrected, and ask for it to be deleted; our Privacy Policy sets out how. Business customers can obtain data-processing terms before any customer data is processed. We operate from the DIFC, under a common-law data-protection posture suited to consent-governed, owned-channel messaging.
What a security review actually asks
Where is our data stored, and who hosts it?
The website runs on Netlify. Its records sit in a Neon Postgres database provisioned for PatternSix alone, not a shared multi-tenant store, with traffic encrypted in transit.
Which providers process personal data?
Three, and no others: Netlify for hosting and delivery, Neon for the database, and Resend for transactional email. Each receives only what its function needs, and the full list is published as our Sub-processor List.
What can your AI colleagues do without a human?
They draft copy, maintain triggers, segment contacts and schedule sends, and may adjust timing and variants within approved templates. They cannot alter approved journey logic or consent rules; a named human owner signs those off first.
What happens if you discover a security incident?
We publish a route to report vulnerabilities, and a named human owner holds the response. We do not publish a fixed notification window; handling follows our Privacy Policy and the DIFC data-protection posture we operate under.
What rights does an individual have over their data?
They can ask what we hold about them, ask for it to be corrected, and ask for it to be deleted. Our Privacy Policy sets out how each request is handled.
Which security certifications do you hold?
None. PatternSix holds no SOC 2 or ISO 27001 certification and has commissioned no independent audit or penetration test. What exists is a single provisioned database, encryption in transit, a published sub-processor list and consent enforced by category.
What availability commitments do you make?
None yet. We publish no uptime figure and offer no service-level agreement. The site runs on Netlify's hosting; we would rather state that plainly than quote a number we cannot stand behind.
Bring your reviewer; we will answer the specifics
If your approval process needs detail this page does not cover, put the questions to a named human who owns the response.