Tenant isolation and access control
- Tenant-scoped data stores and project-scoped API keys.
- Role-based access control on console and API actions, with least-privilege defaults.
- Send scope (tenant, project, sender) is derived from the authenticated session and never accepted from client input.
Encryption and secrets
- TLS for data in transit across the API, console, and mail submission.
- Encryption of sensitive data at rest.
- Provider credentials and signing keys are held server-side and are never rendered to the browser or returned by the API.
- Secrets are managed outside source control and rotated on exposure.
Mail-stream and sending security
- Critical mail (authentication, billing, security) is isolated from marketing and warm-up traffic across separate lanes and sending reputation.
- Pre-send content scanning blocks payment-card numbers and other risky content before enqueue.
- Owned MTAs enforce authenticated submission only and are not open relays; DKIM signing, SPF alignment, and forward-confirmed reverse DNS are required before production sending.
- Abuse controls: vetting, risk tiers, throttles, and suspension workflows.
Operational security
- Access and delivery logging with monitoring and alerting.
- A vulnerability-management process with defined remediation and retest timelines for Critical and High findings.
- Change management through reviewed, tested deployments.
- Regular review of controls as the platform evolves.
Compliance posture
We publish our posture honestly. We support GDPR and UK GDPR through our Data Processing Addendum and the tooling described on our GDPR page. Formal certifications are tracked on the SOC 2 page as they progress; where a certification is in progress rather than complete, we say so.
PulsePigeon is not currently a HIPAA BAA tier; do not send PHI without a signed agreement in place.
Reporting a vulnerability
We welcome responsible disclosure. If you believe you have found a security vulnerability, email [email protected] with details and reproduction steps. Please give us a reasonable opportunity to remediate before public disclosure, and do not access or modify data that is not yours.
We will acknowledge your report, keep you updated, and credit researchers who wish to be recognized.