How we protect your data.

What we will never do

The rest of this page describes controls, and controls change over time. The commitments below do not. They are the reason the controls exist, and we will write every one of them into your contract.

1. What data we receive

2. Architecture

Much of our security comes from how the system is built. Data we never collect cannot leak.

• • On-prem agent: a single-file Python script (about 370 lines) using only the standard library. It runs inside your network, polls your FlexLM (FlexNet) or RLM daemon every 5 minutes, and pushes summary records out over HTTPS. It opens no inbound port, accepts no commands, and has no remote-execution path. Your firewall needs no new inbound rule. The source is downloadable. Have your security team read all of it, and run it under a dedicated non-administrator account (our sample installers use root / LocalSystem; change that).
• • Outbound only: every connection is initiated from inside your perimeter. We never connect in.
• • Read-only by construction: the agent runs the license daemon's status command. It cannot check out, release, or reserve a license, and it cannot change your license server's configuration.
• • Per-tenant isolation: customers share one database; every customer API route checks that the organisation, and each object requested within it, belongs to the caller. Automated tests cover cross-tenant access. LicensePulse's own administrators can see across organisations for support.
• • Three ways in, all of them yours to choose: the agent, read-only OAuth for SaaS seats, or a file you upload. You are never required to grant OAuth to use the product; the engineering path needs no credentials of yours at all.

3. Where your data lives

• • Application + database: Render.com, US Oregon region (Render's own SOC 2 Type II attestation covers its infrastructure, not LicensePulse). We do not offer hosting outside the United States, or on your premises, today.
• • Database: PostgreSQL managed by Render, encrypted at rest by Render. Not deployed in a high-availability configuration.
• • Customer-uploaded contract documents: stored as binary blobs in the same Postgres instance.
• • AI classification: only when you use Smart Upload or the assistant: the column names and first 30 rows of an uploaded file, or your portfolio summary figures, are sent to Anthropic (Claude). Under Anthropic's commercial terms these are not used to train models; Anthropic may retain them for a limited period under its own policies.
• • Email: sign-in, invitation, alert and contact-form emails are sent through Resend (USA). No third-party analytics or ad networks; our web pages load fonts from Google Fonts.

4. Encryption

5. Access controls

• • Authentication: email + password, JWT-based session tokens. TOTP MFA available today. SSO (SAML/OIDC) is on the roadmap and not shipped yet; see below.
• • Authorization: three roles: Owner, Admin, Viewer. Every organisation-scoped API route checks membership and that requested objects belong to that organisation. An Owner can require MFA for the whole organisation through the API; there is no switch for it in the app yet.
• • Internal access: production access is held by the founders. There is no shared administrative account. Platform administrators can view customer organisations for support; that access is not yet comprehensively logged.
• • API keys: scoped to a single organization, revocable instantly.
• • Audit log: records logins (successful and failed, for existing accounts), MFA changes, API-key creation and revocation, product deletion and administrative changes. Not every data change is logged yet. Owners and Admins can export it to CSV.

6. Data processing & privacy

You are the controller and we are the processor. That split matters because it decides who makes decisions about your data, and the answer is you.

• • DPA with EU Standard Contractual Clauses: available on request, signable before you send us anything. Read it here.
• • Purpose limitation: your data is used to operate the service for you. It is not used to build products for anyone else, and it is not used to train models.
• • Retention: active for the term, then 30 days to export, then deleted from active systems within 30 days and from backups within 90 as they age out. Written confirmation of deletion on request.
• • Data subject requests: export and correction are self-serve in the app. Deletion is carried out by our team on request; we handle requests within 45 days.
• • Delete on demand: you do not have to wait for a term to end. Ask and we delete.
• • Sub-processor changes: at least 14 days' advance notice, always.

7. Responsible AI

LicensePulse uses a language model in two narrow places: classifying the columns of a file you upload, and answering questions about your own portfolio in the assistant. Here is exactly what that means.

• • What is sent: the column names and first 30 rows of a file you upload, for classification; your portfolio summary figures (products, seats, costs, renewals, alerts) for the assistant. Never your contract PDFs.
• • Who processes it: Anthropic, under its commercial terms and data-processing addendum. Inputs are not used to train models; Anthropic may retain them for a limited period under its own policies.
• • The model never decides anything on its own. It classifies and it summarises, and it is instructed to answer only from your data in our database. Treat its answers as summaries and check figures on the product pages.
• • Show your work: where the assistant states a number, you can open the underlying product and see the usage records it came from. You cannot defend a number in a negotiation if you cannot trace it, and an undefendable number does more harm than none.
• • It is instructed to say when it does not know. We would rather return "the data does not cover that period" than a confident answer built on a gap.
• • No AI-driven decisions about people: the model is never used to evaluate, rank, or score an individual employee. See what we will never do.
• • Turning it off: there is no per-organisation switch yet. Nothing is sent unless someone uses Smart Upload or the assistant; if you need both off, we will agree that in writing. The rest of the product works without them.

8. Sub-processors

We use a short list of vendors, each under its standard data-processing terms.

We give customers at least 14 days' advance notice of any new sub-processor. Subscribe by emailing privacy@licensepulse.app.

9. Incident response

• • Incidents are handled directly by the founders. A written incident-response procedure with roles and severity levels exists in draft and is awaiting founder approval.
• • Affected customers notified within 72 hours of confirmed discovery (GDPR-aligned, faster than CCPA's "without unreasonable delay").
• • Notification: email to your primary contact.
• • Post-mortem with root cause + remediation plan within 14 days.

Report a vulnerability: security@licensepulse.app. We respond within 5 business days and credit responsible disclosure publicly.

10. Backups & disaster recovery

We count a backup as working only after restoring from it, and we do not claim a drill history we do not have.

11. Compliance posture

12. Company & continuity

LicensePulse is a software company building measurement tools for engineering software licensing. Our contracting entity is named in the Terms of Service, the Privacy Policy, and the DPA, which are the documents your procurement team will actually sign. More about why we built this.

We are a small team, and we will not pretend otherwise in a security review. Concentration risk is a fair question to ask a company at our stage, so here is how we answer it:

• • You reach people who build the product. Support is not a tier that filters you away from the engineers. A bug reported on Tuesday is not queued behind a roadmap.
• • We do not run a 24/7 on-call rotation. If production breaks overnight in your timezone, it may be some hours before we respond. We would rather say that than sell a service level we cannot measure.
• • You are never trapped. Everything exports at any time, in a documented open format that works without us: your data, your usage history, your evidence packs. If we were to disappear tomorrow you would still walk into your renewal prepared. That is the real answer to the continuity question, and it is why the export commitment above is unconditional.
• • Escrow: for enterprise agreements we will arrange source and data escrow on request.

13. Security roadmap

What is shipped, what is not, and what we will do when asked. Nothing in the "planned" column is being sold as though it exists.