← Back to clearpulse.app

Security

Last updated: July 2026

Security is not an afterthought at clearpulse — it is part of the architecture from day one. This page describes how we protect your data and what we expect from providers we rely on.

1. Infrastructure security

• Supabase (database & auth). All data is stored in a PostgreSQL database managed by Supabase. Data is encrypted at rest using AES-256 and in transit using TLS 1.2 or higher. Supabase holds SOC 2 Type II certification and is GDPR-compliant.
• Vercel (hosting).The clearpulse application runs on Vercel's serverless infrastructure. Vercel is SOC 2 Type II certified and GDPR-ready. Application logs are retained for up to 30 days and are not shared externally.
• Cloudflare (CDN & DDoS protection). All traffic to clearpulse.app passes through Cloudflare, which provides DDoS mitigation, edge caching, and bot protection. Cloudflare may log anonymised request metadata (IP addresses, browser type) for security purposes.

2. Application security

• Row-level security (RLS).Every database table enforces RLS policies scoped to your user ID. One user cannot read, write, or delete another user's data — this is enforced at the database level, not only in application code. Even if an application-layer bug existed, the database would reject the query.
• JWT authentication. All authenticated API routes verify a signed JWT issued by Supabase before processing any request. Routes that receive a missing or invalid token return 401 and perform no data access.
• Rate limiting. All AI and API routes are rate-limited per user. The chat and streaming AI routes allow a maximum of 15 requests per minute. Research routes allow 20 requests per minute. Limits are enforced server-side.
• CAPTCHA on public forms. The waitlist signup form is protected by Cloudflare Turnstile to prevent automated abuse.
• Input sanitisation and XSS protection. User-generated content rendered as HTML (e.g. shared documents) is sanitised server-side using DOMPurify before rendering. Inline scripts and event handlers are stripped. User-supplied text sent to AI models is wrapped in structured data tags to prevent prompt injection.
• Security headers. All responses include standard security headers: X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and Content-Security-Policy.
• Supply chain. Our CI pipeline runs npm audit at high severity on every push. Dependencies are reviewed before addition.

3. Data access controls

• Least privilege. Each AI agent receives only the context it needs for its specific task. An email-drafting agent sees only the relevant deal and contact — not your entire pipeline. No cross-user data is passed to any agent.
• Server-side secrets. Database service-role keys, AI provider keys, and OAuth secrets are stored in server-side environment variables only. They are never exposed to the browser, never stored in the database, and never logged.
• No cross-user data access.The application never constructs queries that could return another user's data. Every query includes an explicit user ID filter, and RLS provides a second enforcement layer at the database.

4. Email integration security

• Minimal OAuth scopes. When you connect Gmail, clearpulse requests only the scopes it needs: read and label-management access to your email threads, and send access to send emails on your behalf. We do not request access to your contacts list, Drive, or any other Google service.
• Encrypted refresh tokens. Gmail refresh tokens are stored encrypted in your Supabase account row. The encryption key is stored in a separate server-side environment variable, not in the database.
• Revoke at any time.You can revoke clearpulse's Gmail access at any time from your Google Account → Security → Third-party apps. Revoking access immediately stops all Gmail activity.
• No email content in logs. Email bodies are never written to application logs or usage logs. They are processed in-memory to generate AI context and are not persisted outside your own database row.

5. Responsible disclosure

If you discover a security vulnerability in clearpulse, please report it responsibly. Do not exploit the vulnerability or access data beyond what is needed to demonstrate the issue.

Email your findings to support@clearpulse.app with a clear description of the issue and steps to reproduce it. We will acknowledge your report within 72 hours and aim to resolve confirmed vulnerabilities within 14 days. We do not currently run a public bug bounty programme, but we will credit responsible disclosures in our changelog with your permission.

6. What we don't do

• No advertising networks. We do not use any advertising network, tracking pixel, or cross-site tracking analytics SDK (no Google Analytics, no Mixpanel, no Segment). The two third-party scripts on this page are the Cloudflare Turnstile widget on the waitlist form and Vercel Web Analytics — a cookieless, first-party page-view counter that sets no tracking cookie and collects no personal data.
• No data selling or renting. Your data is never sold, rented, or traded to any third party for any purpose.
• No AI training on your deal data.The content of your deals, contacts, emails, and notes is never used to train AI models — not ours, not a provider's. AI inference runs on your data to generate a response in the moment, but that data is not fed into any shared training pipeline.
• No persistent access beyond what you grant. If you disconnect Gmail or revoke OAuth access, clearpulse immediately stops reading your email. We do not retain cached copies of your inbox beyond what is stored in your own database row.

Questions?

Security questions or concerns: support@clearpulse.app
We respond to all security-related emails within 72 hours.