Trust & Security at LicensePulse
LicensePulse helps engineering and IT teams understand their software license usage. That means we receive sensitive operational data: license logs, seat counts and contract details. This page summarizes how we protect that data.
Last updated: October 28, 2026
1. What data we receive
| Category | Examples | How it gets to us |
|---|---|---|
| Account data | Your name, work email, company name | When you sign up |
| License usage data | Counts of seats in use, peak concurrency, usernames, and denial events where your uploaded data contains them | Smart Upload (file drop), OAuth integrations (M365, Salesforce, Jira, GitHub, Slack, Google Workspace), or our on-prem agent |
| Contract metadata | Vendor names, renewal dates, costs, contract documents you upload | You enter or upload it |
| Telemetry | Page views, funnel events, error stacks. First-party only, stored in our own database. No third-party analytics or error-monitoring service. | Automatic |
We do not receive your source code, your engineering models, your project files, or anything outside what your license daemon emits.
2. Where data lives
- Application runs on Render.com (US data center, Oregon region). No hosting outside the United States, and no self-hosted version, is offered today.
- Database is PostgreSQL, hosted by Render in a single region (no high-availability replica), encrypted at rest by Render
- Customer-uploaded contract documents are stored as binary blobs inside the same Postgres instance
- AI features (only when used): Smart Upload sends the column names and first 30 rows of an uploaded file, and the assistant sends your portfolio summary figures, to Anthropic (model: Claude). Under Anthropic's commercial terms these are not used for training; Anthropic may retain them for a limited period under its own policies. There is no per-organization switch yet; if you need these features off, we agree that in writing.
- Email: sign-in, invitation, alert and contact-form emails are sent through Resend (USA).
- No third-party analytics or ad networks. Our web pages load fonts from Google Fonts.
3. Encryption
- In transit: HTTPS only on every endpoint (
https://app.licensepulse.app,https://licensepulse.app, agent to API), with HTTP redirected and HSTS set; TLS 1.2 and 1.3 are offered. - At rest: volume-level encryption of the Postgres database by Render, with provider-managed keys (Render's statement). OAuth tokens are additionally encrypted at the application layer. MFA secrets and uploaded contract files are not additionally application-encrypted.
- API keys for the on-prem agent are stored as SHA-256 hashes, so even we cannot recover the plaintext.
- Passwords are hashed with bcrypt.
4. Access controls
- Authentication: email and password (minimum 12 characters), JWT-based session tokens, optional per-user TOTP MFA. SSO (SAML/OIDC) is not available. An Owner can require MFA for the whole organization through the API; there is no switch for it in the app yet.
- Authorization: role-based, with Owner, Admin and Viewer roles. Customers share one database; every organization-scoped API route checks membership and that requested objects belong to that organization, with automated cross-tenant tests.
- Internal access: production access is held by the founders. There is no shared administrative account. Platform administrators can view customer organizations for support; that access is not yet comprehensively logged.
- Audit log: logins, MFA changes, API-key creation and revocation, product deletion and administrative changes are recorded and exportable. Not every data change is logged yet.
- API keys are scoped to a single organization, can be revoked instantly, and are never shown twice (only on creation).
5. Sub-processors
We use a small set of vendors. The full list with locations and purposes is at https://licensepulse.app/legal/subprocessors.html. Summary:
- Render (USA): hosting and Postgres
- Anthropic (USA): Smart Upload classification and the AI assistant, only when used
- Resend (USA): transactional email
- Cloudflare: DNS, email routing, edge network
- Stripe (USA): card payments, if used (we never see card numbers)
- Slack / Microsoft / Google / Atlassian / Salesforce / GitHub: only when you connect them via OAuth (off by default)
6. Incident response
- Incidents are handled directly by the founders. A written incident-response procedure with roles and severity levels exists in draft and is awaiting founder approval.
- Affected customers are notified within 72 hours of confirmed incident discovery (GDPR-aligned, faster than CCPA's "without unreasonable delay").
- Notification channel: email to the primary contact.
- A post-mortem with root cause and remediation plan is shared within 14 days.
Report a vulnerability to security@licensepulse.app. We do not run a paid bug-bounty program; we aim to respond within 5 business days.
7. Backups & disaster recovery
- Every night we back up the production database to off-site object storage with a separate provider, which encrypts the copies at rest. Each run checks the backup before upload and confirms its size once stored.
- Our hosting provider (Render) also offers point-in-time recovery of the database.
- On 18 October 2026 we restored both an off-site backup and a point-in-time recovery into isolated databases, and every table matched production.
- We do not yet encrypt backups ourselves before upload. That step is built and tested but not yet switched on in production.
- We do not publish a recovery time (RTO) or recovery point (RPO).
- We count a backup as working only after restoring from it, and we do not claim a drill history we do not have.
8. Compliance posture
| Standard | Status |
|---|---|
| GDPR | Self-assessed: DPA available, EU SCCs incorporated; not externally audited |
| CCPA / CPRA | Self-assessed: disclosures in Privacy Policy, request handling within 45 days |
| SOC 2 Type 1 | Not certified. No audit is scheduled. |
| ISO 27001 | Not pursued |
| Penetration test | None performed |
| HIPAA / PHI | Not in scope. Do not upload Protected Health Information |
| FedRAMP | Not in scope |
9. Your rights & how to reach us
- Data subject requests (GDPR Articles 15 to 22, CCPA equivalent): email privacy@licensepulse.app
- Security disclosures: security@licensepulse.app
- Legal notices: legal@licensepulse.app
- General inquiries: support@licensepulse.app
10. Changes to this page
When the underlying practice changes, we update this page and update the "Last updated" date. Material changes are also announced by email.
Meridian Vertex LLC, doing business as LicensePulse 817 S MacArthur Blvd, Ste 115 #1040, Coppell, TX 75019, USA https://licensepulse.app