Who we are
PulsVault is a zero-knowledge password and secrets manager. We are the data controller for the account information described below. Where you use PulsVault through an employer, a family organizer, or a team owner, that organization is the controller for the vault content shared inside their organization, and we act as their processor.
This policy covers our website, the web console, our mobile applications, and the DevOps Secrets API. It does not cover third-party sites we link to.
What we cannot see
Encryption and decryption happen entirely in the client — your browser or app. The key that protects your vault is derived from your master password on your device and is used to wrap a chain of keys that we only ever store in encrypted form. Specifically, the following never reach our servers in plaintext:
- Your master password, and the secret derived from it.
- Your user master key and the per-vault data encryption keys.
- The contents of vault items — passwords, notes, card details, custom fields, attachments and their file names.
- Your Access Key and Recovery Key. We store only a one-way hash of each.
- The symmetric key for a secure share link, which lives only in the fragment of the URL you send and is never transmitted to us.
What we do store is ciphertext plus the metadata needed to route it: which vault an item belongs to, when it was created or modified, and its type. See our security model for the full key hierarchy.
What we collect
Account data
Your email address, your display name, your chosen plan, and your account status. We need these to create an account, send you service messages, and apply your plan's limits.
Security and device data
To detect account takeover we record sign-in events with the IP address and user-agent that produced them, a device fingerprint tag used to bind a session to the device that opened it, and the trusted-device records you approve. Repeated failed authentication from an address results in temporary blocking of that address.
Audit data
Security-relevant actions — signing in, unlocking a vault, sharing, permission changes, key rotation, API-key use — are written to a tamper-evident, hash-chained audit log tied to your account and, where relevant, your organization. Entries record that an action happened, not the plaintext it acted on.
Billing data
Your subscription tier, billing period, and payment status. Card numbers are handled by our payment processor and never touch our servers; we receive a customer reference and the result of the charge.
Support data
If you contact us, we keep the correspondence and whatever you choose to include in it. Please do not send us secrets — we cannot read your vault, and we do not want a copy in a mailbox.
Breach monitoring
If you enable breach monitoring, we check the email addresses you nominate against a third-party breach corpus and store the results so we can alert you. Password breach checks are performed without disclosing your password.
How we use it
- To operate the service: authenticate you, sync your encrypted vault, and enforce your plan's limits.
- To keep accounts safe: rate limiting, IP blocking, anomaly detection, and the audit trail you can inspect.
- To bill you, and to handle refunds, dunning and tax obligations.
- To send service messages — verification, password changes, security alerts, and plan notices.
- To provide support when you ask for it.
- To meet legal obligations, and to establish or defend legal claims.
Legal bases
Where the GDPR or equivalent law applies, we rely on the following bases:
| Purpose | Basis |
|---|---|
| Providing the service you signed up for | Performance of a contract |
| Security, abuse prevention, audit logging | Legitimate interests |
| Billing, tax and accounting records | Legal obligation |
| Optional features such as breach monitoring | Consent, withdrawable at any time |
Who else processes it
We keep the list of subprocessors deliberately short. Each is bound by a data processing agreement, and none of them can read your vault contents — what they hold is either ciphertext or account-level data.
| Provider | Purpose | Data involved |
|---|---|---|
| Stripe | Payments and subscription billing | Name, email, payment details, billing history |
| Resend | Transactional email delivery | Email address, message content |
| Amazon Web Services | Encrypted file storage and key management | Encrypted attachment blobs, wrapped keys |
| Have I Been Pwned | Breach monitoring, only if you enable it | The email addresses you nominate |
If you connect an optional cloud integration such as Google Drive or OneDrive for backups, that provider receives the encrypted export you send it. We announce material changes to this list before they take effect.
How long we keep it
- Vault data — until you delete it. Deleted items go to trash first, then are removed permanently.
- Account data — for the life of the account. When you delete your account it is erased from our live systems 14 days later, and from our backups when those backups expire. Deleting an organization erases it and every account in it the same way.
- Accounts whose plan ended — read-only for 14 days, then locked. An account that stays locked for 90 days is deleted after a further 14-day countdown, unless you subscribe; we email you 30, 7 and 1 days before it is erased, and buying a plan at any point cancels it. An organization is deleted with every account in it.
- Departure records — when an account is deleted, we keep an anonymous record of its plan, its size and the reason given, so we can learn why customers leave.
- Audit logs — for the retention window your plan provides, after which entries age out automatically. Audit records are kept for their retention period even after an account is deleted, as a security record — the log is tamper-evident, so an entry cannot be removed early without breaking it. A small number of security records, such as the download of an organization backup, are kept permanently.
- Security events — IP blocks and failed-attempt counters expire on their own, typically within days.
- Billing records — for as long as tax and accounting law requires, usually several years.
Sessions and unlock state are held in ephemeral storage and disappear when they expire or when you lock your vault.
Your rights
Depending on where you live, you have some or all of the following rights. You can exercise most of them yourself from your account settings, immediately and without asking us.
- Access — get a copy of the personal data we hold about you.
- Portability — export your vault at any time in a standard format, decrypted on your device.
- Rectification — correct your account details from your profile.
- Erasure — delete your account, which removes your vaults and account data.
- Objection and restriction — object to processing based on legitimate interests.
- Withdraw consent — turn off optional features at any time, with no effect on prior processing.
- Complain — lodge a complaint with your local supervisory authority.
How we protect it
- AES-256-GCM authenticated encryption for vault data, with a unique initialisation vector per encryption.
- Key derivation from your master password with a high iteration count, performed on your device.
- TLS for everything in transit, and encryption at rest for stored ciphertext and backups.
- A two-gate model: authenticating gets you into your account, unlocking gets you into your vault, and the second gate expires on its own.
- Rate limiting, replay protection, IP blocking and a hash-chained audit trail that makes silent tampering detectable.
- Least-privilege internal access; no member of staff has a path to your plaintext.
No system is perfect. If you believe you have found a vulnerability, please report it to security@pulsvault.com rather than disclosing it publicly, and we will work with you on a fix.
International transfers
Some of our subprocessors operate outside your country. Where personal data is transferred out of the European Economic Area or the United Kingdom, we rely on adequacy decisions or on Standard Contractual Clauses together with technical measures. In practice the strongest of those measures is the one built into the product: what crosses a border is ciphertext.
Children
PulsVault is not directed at children under 13, and we do not knowingly collect their data through a self-service signup. A family organizer may create a supervised member account for a child under their own responsibility, subject to the controls on the family plan. If you believe a child has created an unsupervised account, contact us and we will remove it.
Changes to this policy
We update this policy when the product changes or the law does. The date at the top of the page always reflects the current version. For material changes — a new subprocessor, a new category of data, a new purpose — we notify you by email or in the console before the change takes effect, so you have time to object or leave.
Contact us
Privacy questions, data requests, and anything you would like explained in plainer language: privacy@pulsvault.com. For anything else, write to hello@pulsvault.com. We answer data requests within one month, and tell you sooner if we need longer.