- Isolation: every record belongs to one workspace, and the database enforces separation with row-level security. Agency clients are separated from each other too.
- Credentials: provider tokens are encrypted before storage, with the key held outside the database.
- Least access: Pulse requests the narrowest provider permissions available.
- Staff access: InnoStak staff use separate accounts with their own roles. Support access to a customer is read-only, time-limited and logged.
- Audit trail: sensitive actions, including invitations, role changes and staff actions, are recorded.
Pulse doesn't hold SOC 2 or ISO 27001 certification today.