Loading
Effective date · 1 June 2026
PulseSignal stores customer configuration, saved searches, alert rules, billing references, and the aggregated public-source intelligence we deliver back to you. This page is the canonical description of the controls we use to protect that data, our certification posture, and how to reach us if you find a vulnerability. It supplements our Privacy Policy and forms part of the agreement under our Terms of Service.
We do not claim certifications we have not earned. Our current posture is:
We rely on a small number of vetted service providers to run PulseSignal. The complete list, what each one does, where they are located, and the safeguards we have in place with them, is maintained at /privacy/sub-processors. Material additions are announced on that page and by email to active customers at least 30 days before the new provider begins processing customer data.
Our primary application and database are hosted in the United States (Ashburn, Virginia). All customer data is written to that US infrastructure by default, and backups are stored within the same region.
Where personal data is transferred from the European Economic Area, United Kingdom, or Switzerland to the United States, we rely on the European Commission Standard Contractual Clauses (Module 2 controller-to-processor and Module 3 processor-to-processor) for EU transfers, the UK International Data Transfer Addendum (IDTA) for UK transfers, and the EU SCCs as modified by the Swiss FDPIC for Swiss transfers, all incorporated into each sub-processor’s DPA. The full list of US-based sub-processors (billing, error monitoring, product analytics) is in the sub-processor list.
The full Vulnerability Disclosure Programme (scope, safe-harbor terms, acknowledgement and remediation SLAs, and a public-credit pathway) is published at /security/responsible-disclosure. That page is the canonical source of truth; the summary below restates the headline commitments so a security questionnaire can be answered without leaving this page.
If you believe you have found a security issue in PulseSignal, please email security@pulsesignal.co. Our contact and disclosure policy are also machine-readable at /.well-known/security.txt (RFC 9116). A PGP key is available on request to security@pulsesignal.co if you need to encrypt a sensitive report.
Please give us a reasonable window to investigate and remediate before public disclosure. In return, we commit to:
In scope: pulsesignal.co, www.pulsesignal.co, app.pulsesignal.co, and the public REST API at api.pulsesignal.co. Test against your own account only.
Out of scope: denial-of-service attacks, social-engineering or phishing of PulseSignal employees, physical attacks, automated scanner output without a working proof-of-concept, missing best-practice HTTP headers without a demonstrable impact, and any testing against customer accounts other than your own.
We classify incidents on a four-tier severity scale. The acknowledgement and resolution targets below apply to confirmed reports from customers and from external researchers.
| Severity | Example | Acknowledgement | Resolution target |
|---|---|---|---|
| Critical | Confirmed data exposure, active exploitation, or full Service outage. | Within 1 hour | Mitigation within 4 hours; root-cause notice within 72 hours. |
| High | Authenticated privilege escalation, partial outage of a paid feature, or material data integrity bug. | Within 4 hours | Mitigation within 24 hours. |
| Medium | Bug with a workaround, non-sensitive information disclosure, or degraded performance. | Within 1 business day | Mitigation within 72 hours. |
| Low | Cosmetic or low-impact issues, hardening suggestions, missing best-practice headers. | Within 2 business days | Mitigation within 7 days, or scheduled into the next release cycle. |
If an incident affects personal data of EU, UK, or Swiss residents, we will notify the relevant supervisory authority and affected data subjects in line with our legal obligations and, where applicable, within 72 hours of becoming aware of it. Customer-side notifications go to the primary billing contact and to any security contact you have configured.
We run a private disclosure-only programme today: there is no monetary reward, but every valid report receives acknowledgement, a status update through to resolution, and (with your consent) public credit. Reports are submitted by email to security@pulsesignal.co.
We intend to move to a paid HackerOne programme once paying-customer revenue justifies the engagement. We will publish the scope, severity-to-bounty table, and safe-harbour terms on this page when the paid programme opens.
Security disclosures: security@pulsesignal.co.
Privacy questions: privacy@pulsesignal.co.
Product and support: hello@pulsesignal.co.
DPA, security questionnaire, audit-report requests (Business+): email privacy@pulsesignal.co with your account name.
We will update this page as our controls, sub-processors, and certification posture change. The effective date at the top reflects the most recent revision. Material changes are announced by email to active customers at least 30 days before they take effect.