Security
How Pulse protects your data, and how to report a security issue if you find one.
Our security principles
Zero-knowledge encryption
When you sync contacts to Pulse Cloud Sync from the Pulse app, your data is encrypted on your device before it leaves it. We store the encrypted blobs but cannot read them — only your devices have the key.
Defense in depth
Every layer is hardened independently: encryption in transit and at rest, one-way hashed passwords, automatic lockout and rate limiting against brute-force attempts, per-user isolation, and least-privilege access between our services.
No secret sauce
We use boring, well-audited, industry-standard cryptography and infrastructure, implemented in the standard ways.
Transparency
Our privacy policy describes exactly what data leaves your device, where it goes, and how it's protected. We don't hide trade-offs (e.g., the Apple Contacts CardDAV path is plaintext because Apple's client requires it, and we say so).
For the full security architecture, see Section 11 of our Privacy Policy.
Responsible disclosure policy
We take security reports seriously. If you believe you've found a vulnerability in Pulse, please report it to us privately so we can fix it before details become public.
How to report
Email security@pulserelationships.com with:
- A clear description of the vulnerability
- Steps to reproduce
- The version of Pulse and the platform you tested on
- Your name or handle (if you'd like credit)
What you can expect from us
- Acknowledgment within 5 business days of receiving your report
- An honest assessment of the issue's severity and our planned fix timeline
- Regular updates as we investigate and patch
- Public credit on this page once the fix ships, if you want it
What we ask in return
- Give us a reasonable disclosure window (typically 90 days, sometimes longer for complex issues) before publishing details
- Do not exploit the vulnerability beyond what is necessary to confirm it exists
- Do not access, modify, or delete data belonging to other users
- Do not run automated scans against our production infrastructure that could degrade service
We do not currently run a paid bug bounty program. We may in the future as Pulse grows.
Security acknowledgments
Thank you to the security researchers who have helped make Pulse safer through responsible disclosure. Researchers are listed in the order of report.
No reports yet. Be the first.
Security contact
For all security issues, vulnerability reports, and responsible disclosure:
security@pulserelationships.com
For general support questions, use /support instead.