Trust is earned, not claimed
Security for website and app monitoring: how Pulse protects your access
Monitoring means trusting us with access to your infrastructure. Here's, in plain language, how InnoStak Pulse is designed to keep that access narrow and accountable. Pulse is new and in pilot, so these describe how it's built to work — not an audited certification.
Least access, most accountability
Security controls Pulse is built around
Nine areas, from provider scopes to payment handling. Each one describes a design commitment, written so you can repeat it to your own clients.
- 01
The narrowest access we can get
- Pulse is designed to request read-only scopes wherever Vercel and Supabase offer them.
- If a provider only offers broader access, setup is built to tell you so instead of pretending it's read-only.
- Pulse doesn't ask for your database password or Supabase service-role key.
- 02
Encrypted provider credentials
- Pulse is built so that provider tokens are encrypted by the application (AES-256-GCM) before they're stored.
- The encryption key is designed to live outside the database, so a database copy alone wouldn't reveal your tokens.
- Tokens are designed never to appear in the browser, in logs or in AI prompts.
- 03
Tenant isolation
- Pulse is built so that row-level security applies to every table, and each workspace only reads its own data.
- Agency client users are designed to be scoped to their organization or projects, never the whole workspace.
- Requests for another tenant's data are designed to get the same “not found” as data that doesn't exist.
- 04
Access that ends when it should
- Permissions are designed to be checked against live membership on every request, so removed members lose access right away.
- Invitations are designed to be single-use, to expire, and to work only for the verified email they were sent to.
- Workspace owners are designed to be asked for multi-factor authentication before sensitive billing and admin actions.
- 05
Checks that can't be turned against you
- Monitors are designed to call public HTTPS addresses only.
- Pulse is built to block private, loopback, link-local and cloud-metadata addresses, and to re-check every redirect.
- Requests are designed with strict time and size limits.
- 06
AI with guardrails
- AI is designed to see only bounded, redacted evidence you're allowed to see, for the selected time period.
- Logs and page content are treated as untrusted data, not instructions.
- The AI is built without tools that can change your systems, and reports are designed never to be shared across audiences.
- 07
Audit logs and staff access
- Pulse is designed to record incident changes, membership changes and billing actions in audit logs.
- InnoStak staff are designed to use a separate admin area with its own roles.
- Support access is designed to be read-only, need a stated reason, expire, and be audited itself.
- 08
Payments handled by Stripe
- Checkout and billing management are built on Stripe. Pulse is designed never to store card numbers or CVV.
- Prices are designed to be allowlisted on our server, so the browser can't change what you're charged.
- 09
Verified provider events
- Incoming webhooks from Stripe, email and SMS providers are designed to be signature-checked before Pulse acts on them.
- Events are designed to be recorded once and processed idempotently, so duplicates don't cause double actions.
What we don't claim
No compliance badges we haven't earned
InnoStak Pulse is new. We'd rather be precise than impressive.
- 01
No compliance certifications yet. InnoStak Pulse has not completed a SOC 2, ISO 27001 or similar audit, and we don't claim to be certified.
- 02
Backups are not failover. Restoring from a backup isn't the same as automatic failover, and we don't offer an uptime guarantee.
- 03
Deletion takes time. Deleted workspaces go through a recovery period before removal, and data in backups expires on its own schedule rather than instantly.
- 04
Provider limits apply. Some providers only offer tokens broader than read-only. When that's the case, we disclose it during setup.
Report a security issue
Found something, or have a question before you connect your stack? Email hello@innostak.com and a person will get back to you.
Keep watch without handing over the keys.
Start your pilot with read-only access wherever your providers allow it. Business email required.