Pulse Technologies builds payment-grade software. Security is the same discipline whether we're moving a payment or sending a text — here's how the Pulse Social Command Center and Pulse SMS protect your data.
All traffic is served over TLS (HTTPS). API keys and third-party credentials are never exposed to the browser.
Application data lives in managed Postgres (Neon) and object storage with encryption at rest provided by the platform.
Provider keys live only in server-side environment variables. AI calls run through a backend proxy so model keys stay off the client. Stored integration secrets (e.g. archiver tokens) are never echoed back.
Every record is scoped to an organization, and all queries are filtered by org — customers can only ever see their own data.
Product-usage analytics (which screens are used and for how long) are first-party — stored in our own database and shown to your admins to understand engagement. We use no third-party advertising or tracking SDKs, and set no third-party tracking cookies.
Admin, editor, and viewer roles gate every action. Sensitive operations require the admin role.
Two-factor authentication is available, with single sign-on for teams that require it.
Platform support access to a customer org is explicit, time-bound, reversible, and audited, with a visible banner while active.
Connected social and messaging integrations request only the scopes a feature needs.
Text-to-pay sends a secure link to the payment gateway's hosted pages. Card numbers are entered there, not in Pulse — so cardholder data never reaches our systems.
Payments are processed by the Pulse Technologies gateway, a PCI DSS Level 1 service. For text-to-pay, charges settle under the customer's own merchant account.
Payment status updates are verified by HMAC signature before they're trusted, and re-confirmed against the gateway.
Merchant gateway credentials are write-only from the UI and never returned in API responses.
Pulse SMS sends over carrier-registered A2P 10DLC messaging, the standard for compliant business texting in the US.
Every opt-in and opt-out is logged with source and timestamp, and exportable for audits. STOP / START / HELP are honored automatically.
Regulated customers can forward every message to their own archiver (Smarsh, Global Relay, or any HTTPS endpoint) and export a tamper-evident record.
Opted-out numbers are suppressed across one-to-one sends, campaigns, and automated sequences.
Hosting, database, and storage run on managed, redundant cloud platforms (see our subprocessors).
Application errors are monitored so issues are caught and resolved quickly.
We are actively pursuing SOC 2 Type II and building toward it with the controls described above. We're happy to share our current security posture and DPA under NDA — and the report once the audit completes. We are not yet SOC 2 certified, and we'll say so plainly until we are.
Privacy Policy · Terms of Service · Data Processing Addendum · Subprocessors