Security

Pulse doesn't store passwords. You sign in with Google OAuth, so your credentials never touch our servers — authentication is handled entirely by Google, and Pulse only receives a verified session.

Every piece of data in Pulse belongs to exactly one organization, and every request is checked against your membership and role before any data is returned.

Within an organization, project access can be further restricted: owners and admins always see every project, but a member role can be limited to only the specific projects they've been granted access to.

API keys and tokens for connected integrations (Google, WooCommerce) are stored in our database, which is not publicly accessible and is protected by strict infrastructure-level access controls. All traffic between your browser, Pulse, and connected services is encrypted in transit (HTTPS/TLS).

When AI features (insights, the marketing agent, knowledge search) are used, only the specific data relevant to your request is sent to our AI model provider to generate a response — never your full dataset, and never used to train third-party models. Every action the AI drafts, such as an email campaign, requires explicit human review before it can go out; the AI itself has no ability to send or publish on its own.

Pulse runs on managed cloud infrastructure with a PostgreSQL database. We rely on our infrastructure providers' physical and network security controls, and keep our own dependencies and platform up to date.

If you believe you've found a security issue in Pulse, please report it to hello@rojinasafavi.com — we take these reports seriously and will respond as quickly as we can.