Security Overview

PACER does not persist user data. All analyses are performed in-session: user-provided data such as response matrices, item parameters, and Q-matrices is processed transiently and is not retained after execution. No user data is stored, logged, or written to persistent storage by the application.

For organizations requiring full control over their data, PACER also offers a desktop application (Windows and macOS) built with Electron that runs entirely on the user's local machine. In desktop mode the ASP.NET backend is bundled locally and operates fully offline — no data leaves the device unless you explicitly enable the optional Claude Desktop connection described below.

PACER can optionally connect to Claude Desktop (Anthropic's desktop application) so you can drive its analyses in natural language. This connection is opt-in and disabled by default — you must explicitly enable it in Settings. If you never connect it, PACER runs exactly as described above: fully local and offline-capable.

The guiding principle is PACER computes locally; Claude interprets in the cloud. Your data is read and analyzed on your machine by PACER's bundled engine. To explain the results, Claude — which runs on Anthropic's servers — receives the analytic outputs you ask it about. Enabling the connection is therefore not an offline operation: some information is sent to Anthropic. The boundary is precise and under your control:

PACER makes no external network calls for this feature. The local engine and connector run entirely on your machine; it is Claude Desktop that communicates with Anthropic's servers, and the results PACER returns simply become part of that conversation. PACER neither stores nor transmits your data to Anthropic itself.

What this means for compliance. When the connection is enabled, treat it like any third-party cloud AI service: the analytic results and chat text you exchange are transmitted to and processed by Anthropic under Anthropic's privacy policy and the data-use settings of your Claude plan, which you should review. If your data — or its derived results — contains identifiers or otherwise regulated content, confirm that transmitting it to an external AI service is permitted by your organization before connecting. When data must never leave the device, use PACER standalone and leave the Claude Desktop connection disabled.

A note on interpretation. Claude's narration is assistive, not authoritative. PACER produces the exact, verifiable numbers; Claude drafts the read, and the psychometrician confirms it.

The PACER web application is hosted on Microsoft Azure within the United States. The application runs on Azure App Service and benefits from Microsoft's enterprise-grade cloud infrastructure, including:

Infrastructure security, availability, and physical safeguards are managed by Microsoft as part of the Azure platform.

All communication with PACER is encrypted using HTTPS with Transport Layer Security (TLS) version 1.2 or higher. PACER enforces modern cryptographic standards, including forward secrecy (ECDHE key exchange) and authenticated encryption (AES-GCM cipher suites). This ensures that data transmitted between users and the application is protected against interception and tampering.

PACER is hosted on Microsoft Azure, which provides encryption at rest for all underlying storage using industry-standard encryption mechanisms. Because PACER does not write user data to persistent storage, this protection applies to application infrastructure and configuration data only.

Sensitive configuration values — such as service credentials — are stored securely within Azure App Service configuration settings and are not embedded in application code or exposed to end users. PACER follows secure development practices designed to minimize attack surface and reduce the risk of unauthorized access.

PACER is accessible over the public internet via HTTPS only. All traffic is encrypted and no direct access to underlying infrastructure or services is exposed. The application runs within Azure-managed environments that isolate and protect compute resources.

Major versions of PACER are supported for 12 months from their release date. During the support window, security patches and critical bug fixes are provided at no additional cost. After a version reaches end-of-life, no further security patches will be issued for that version. Users are encouraged to upgrade to a current supported version.

Release dates and version history are published in the PACER Changelog. Advance notice of at least 90 days is provided before any version reaches end-of-life.

PACER monitors for security vulnerabilities in its dependencies and application code through the following channels:

When a vulnerability is confirmed, a patch is developed, tested, and released according to the patching SLA below. Customers are notified of security-relevant releases via the changelog. To report a suspected vulnerability directly, contact the developer via paceronline.com.

PACER commits to the following response timeframes for confirmed vulnerabilities, measured from the date of confirmed identification. Severity is rated using the CVSS (Common Vulnerability Scoring System) — an industry-standard 0–10 scale published by NIST.

Before each release, PACER undergoes dynamic security testing against the running application using OWASP ZAP (Zed Attack Proxy), a free and open-source tool maintained by the Open Worldwide Application Security Project. Testing covers the application's HTTP API surface and focuses on the OWASP Top 10, including injection vulnerabilities, broken authentication, sensitive data exposure, and security misconfiguration.

Findings from each scan are reviewed and addressed prior to release in accordance with the patching SLA above.

PACER is not currently certified under formal compliance frameworks such as SOC 2 or FedRAMP. However, it is designed to align with widely accepted security best practices:

These controls are consistent with many of the core principles underlying common security and compliance standards.

Users are responsible for ensuring that any data uploaded to PACER complies with their organization's internal data governance, privacy, and regulatory requirements. PACER's security model minimizes the platform's exposure to sensitive data but does not substitute for the user's own compliance obligations.