Security & trust

Candor depends on confidentiality.

People only answer honestly when they trust it will be protected. Confidentiality isn’t a setting in Pulsings; it’s wired into the architecture.

Confidentiality & anonymity

Individual responses are never shown to the organizer: by design, not by policy.
A minimum-N gate withholds a cycle’s content entirely until at least three people have responded.
A response carries no member or invite reference — who said what is never stored, so it cannot be reconstructed.

Data residency & GDPR

All data stores and sub-processors run in the EU region.
Built GDPR-first: lawful basis, data minimisation, and member rights are first-class.
Member input is treated as sensitive personal data and handled accordingly.

AI providers

We use providers under zero-retention, no-training terms, so your data is not retained or used to train models.
Synthesis prompts carry no organizer identity, keeping each cycle’s readout evidence-bound.
AI usage is metered per pulse for cost transparency.

Authentication & access

Passwordless sign-in via single-use magic links, so there are no passwords to phish or leak.
Every session is verified against the auth server, not trusted from a cookie alone.
Members have no account; they enter through a unique, single-use link for that cycle.

Data isolation

Row-level security enforces that an organizer can only ever reach their own pulses.
Raw responses and completion records are default-deny: reachable only by the trusted server engines, never by the organizer directly.
Organizers see only the guarded cycle readout — counts, trends, and themes.

Infrastructure

Data encrypted in transit (TLS) and at rest by our EU-region managed Postgres provider.
Email delivery runs through an EU-region provider on an authenticated sending domain.
No real personal data is used in development, testing, or fixtures. Synthetic only.

·Sub-processors

Who we rely on, and where they run.

SupabaseManaged Postgres, auth, storageEU

AnthropicAI models (zero-retention)ZDR

ResendTransactional emailEU

StripeCard payments & subscriptionsUS

·Responsible disclosure

Found something? Tell us.

If you believe you’ve discovered a security issue, please email security@pulsings.com. We’ll acknowledge your report and keep you updated as we investigate. Please give us a reasonable window to remediate before any public disclosure.