Security Statement

1. Hosting and Infrastructure

The Platform runs on established, professionally managed cloud infrastructure. Physical security, hardware lifecycle, and network perimeter controls are provided by the cloud provider under its own certified security programmes.

2. Encryption

• In transit — all Platform traffic is served exclusively over HTTPS/TLS.
• At rest — Customer Data is stored on cloud storage services that encrypt data at rest.

3. Authentication and Session Security

• Administrative functions (data upload, register changes, configuration) are protected by a server-verified password. Passwords are salted and hashed using a modern key-derivation function; plain-text passwords are never stored.
• Successful sign-in issues a signed, httpOnly session cookie that cannot be read by page scripts. Session tokens are time-limited and cryptographically verified on every request.
• No secrets are shipped to the browser; all credential verification happens server-side.

4. Multi-Tenant Isolation

• Each tenant's data lives under its own isolated storage location.
• Session tokens carry the issuing tenant's identity and are rejected by every other tenant.
• All server endpoints resolve the requesting tenant before touching data, and read or write only that tenant's storage.

5. Access Control

Access to production systems and Customer Data is restricted on a least-privilege, need-to-know basis. The Platform's role-based access control (Terms of Use, Section 6) lets Customers apply the same principle to their own Authorized Users.

6. Data Handling

• Uploaded workbooks are validated and parsed server-side; the browser never processes another tenant's files.
• Customer Data is used only to provide the service (Terms of Use, Section 11.4) and is returned or securely deleted within thirty (30) days of termination (Section 12.3).

7. Availability and Resilience

The Platform targets not less than 99.5% monthly uptime, excluding Scheduled Maintenance Windows (Terms of Use, Section 14). Routine maintenance is announced at least forty-eight (48) hours in advance; emergency security maintenance may proceed without notice.

8. Vulnerability and Lifecycle Management

Platform dependencies are actively maintained and updated. Fittingly for its own subject matter, the Platform's technology stack is tracked against end-of-support dates, and vendor lifecycle data is monitored through the same third-party sources the product exposes to Customers.

9. Incident Response

Suspected or actual security incidents are triaged promptly. Where an incident affects Customer Data, the affected Customer will be notified without undue delay with the facts known at the time, the likely impact, and the remediation under way.

10. Responsible Disclosure

Pulsus welcomes good-faith security research. Suspected vulnerabilities should be reported to security@pulsus.tech; do not access data that is not yours, degrade the service, or publicly disclose an issue before it has been remediated. Pulsus will acknowledge reports promptly and keep researchers informed of progress.

11. Customer Responsibilities

Security is shared. Customers are responsible for safeguarding their administrator credentials, promptly deactivating departed Authorized Users, configuring role-based access in line with least privilege, and reporting suspected credential compromise immediately (Terms of Use, Sections 4–6).

12. Contact

• Security reports: security@pulsus.tech
• Support: support@pulsus.tech