Each bitpac address is a multisig where you have one key and your friends have the others. The money is safe if your friends are trustworthy. If they aren't, they can vote to steal all the money in the multisig and you won't be able to stop them (unless you give yourself multiple keys and thus make your vote count more than theirs)

That's basically it