Pulseri 
Data Processing Addendum
How we handle personal data on your behalf, with our security measures.
Security
How we protect your data
Customer data stays apart, you set who can do what, and key actions reach an audit log. We list only what is built, and we say what is missing.
Controls
What protects your data today
Every control below is built.
Your data stays apart
Database row-level security limits each request to one customer's data. Asking for another customer's item finds nothing.
Roles you control
You choose what each person can do. Team members can add two-step sign-in.
Single sign-on
Your team signs in with your own identity provider. We check each sign-in's signature and refuse replays.
Automatic user sync
Team members are added, updated and removed from your directory automatically.
An audit log
See who changed sign-in rules, invited people, changed roles or removed anyone. Log entries cannot be edited.
Signed webhooks
Every webhook we send is signed, so you can check it came from us.
Secrets stay secret
Passwords are one-way hashes we cannot read back. A secret key is shown once. Credentials for connected tools are encrypted.
Limited assistant access
An assistant can do only what the person who approved it can do. You can switch assistants off.
Controls
What protects your data today
Every control below is built.
Database row-level security limits each request to one customer's data. Asking for another customer's item finds nothing.
You choose what each person can do. Team members can add two-step sign-in.
Your team signs in with your own identity provider. We check each sign-in's signature and refuse replays.
Team members are added, updated and removed from your directory automatically.
See who changed sign-in rules, invited people, changed roles or removed anyone. Log entries cannot be edited.
Every webhook we send is signed, so you can check it came from us.
Passwords are one-way hashes we cannot read back. A secret key is shown once. Credentials for connected tools are encrypted.
An assistant can do only what the person who approved it can do. You can switch assistants off.
Access
You decide who can do what
Give each person a role that fits their job.
A teammate gets the Results only role. They can see results but not send surveys or change roles. The change is written to the access log.
Maeve DoyleDesigner
Role
- Administrator
- Results only
- Survey sender
What this person can do
- See survey results (Allowed)
- Send surveys (Not allowed)
- Change who has which role (Not allowed)
Access log
Camila Reyes changed Maeve Doyle to Results only.
- Ordinary team members get no sensitive rights by default.
- Every team member can switch on two-step sign-in, using a code from an authenticator app.
- Invites, role changes and removals are written to the audit log.
Sign-in
Sign in your way
Connect your identity provider and sync people from your directory with SCIM.
The domain is verified, the sign-in service is connected, three people sign in with their work account, and the sign-in appears as a line in the activity log.
Your domain
Verifiedbrightpath.example
Checked with a record on your domain
Brightpath single sign-on
ConnectedCamila Reyes · Head of Support
Work accountDana Cohen · Finance Lead
Work accountInes Duarte · Community Manager
Work account
Activity log
Recorded09:14 Camila Reyes signed in with a work account
Signed out after 30 minutes away
- Prove your domain, then require single sign-on for its people.
- Set how long a sign-in lasts. Without your own rule, people are signed out after 2 hours without activity.
- A sign-in that single sign-on blocks is recorded in the audit log.
- Single sign-on: Enterprise, or Business with the SSO add-on. SCIM, required single sign-on and session limits: Enterprise. Custom roles: Growth and up.
Infrastructure
Where Pulseri runs and how we look after it
The facts about hosting, encryption, backups and sign-in, as they are today.
- Pulseri runs on Google Cloud in Belgium, with backups in Google's EU locations. An organisation policy keeps our Google Cloud resources in EU locations. Some of our providers are outside the EU; the sub-processor list says which.
- Connections between your browser and Pulseri use TLS 1.2 or higher.
- Stored data is encrypted at rest with Google's default encryption. Sensitive secrets are encrypted again inside the app.
- The database has no public IP address, and connections to it are encrypted.
- The database is backed up every day and the last 14 backups are kept, plus 7 days of point-in-time recovery.
- Cloudflare's firewall and rate limiting sit in front of the app and the API. Google reCAPTCHA guards sign-in, sign-up and password reset against bots.
- Passwords must be at least 8 characters and are checked against lists of known breached passwords.
- Sensitive actions ask you to confirm who you are again.
- By default you are signed out after 2 hours without activity.
- The audit log keeps the IP address and browser details of each action. Entries are kept for 30 days on Starter, 90 on Growth, 365 on Business and 730 on Enterprise, then deleted. Business and Enterprise can also read the log through the audit API.
Documents
Documents for your security review
What you need to check us, in one place.
Sub-processors
The providers that help us run Pulseri, the data each receives and where.
Security questionnaire
Ask us about security any time. Business and Enterprise can send their own questionnaire.
Limits
What we do not have yet
So you can judge the gaps for yourself.
- We do not hold third-party security certifications today. We will list one here only after we have earned it.
- We have not yet had an independent penetration test.
- Our database runs in a single zone, without a standby copy in another zone.
- We do not offer an uptime guarantee on self-serve plans, and we have no public status page and no 24/7 on-call team. Enterprise customers can agree service terms in a signed contract.
- We do not offer customer-managed encryption keys.
- Admins cannot yet require two-step sign-in for their team.
- You cannot choose where your data is stored, and we do not offer IP allow-lists or audit log streaming yet.
- Some of our providers are in the United States, including those for email delivery and AI. The sub-processor list names them.
- No system is perfectly secure.
Report a problem
Found a security problem?
Tell us what you found and how to repeat it. We will look into every report and reply.
Please do not access other people's data, disrupt the service or share details before we fix it.
Security questions teams ask
No. We hold no SOC 2, ISO 27001 or other third-party certification today. We will list one here only once we hold it.
Database row-level security limits each request to one customer's data, so a mistake in the app should not show your data to another customer. Asking for another customer's item finds nothing. We test this against a real database.
Yes. Sign in with SAML or OpenID Connect, and sync people from your directory with SCIM. Single sign-on comes with Enterprise, or with Business plus the SSO add-on. SCIM is on Enterprise.
Yes. Important actions go to an audit log you can read in the dashboard: sign-in rule changes, single sign-on and SCIM events, invites, role changes and removals, with IP address and browser details. The database refuses changes to log entries.
Yes, on every plan, with no off switch. Anthropic (USA) tags sentiment and themes and writes weekly summaries. We remove email addresses and some phone numbers first; that won't catch everything. Its terms bar training on this data.
We remove their name, email address, traits, picture and ID, and scrub their stored events. Answers, including comments, stay. A one-way hash of a blocked address is kept so we never email it again. Ask us to remove specific comments.
Need more for your security review?
Ask us anything. Business and Enterprise customers can also ask us to fill in a security questionnaire.