Security & Trust

Accounts and sign-in

• Passwords are stored only as salted bcrypt hashes.
• Sign-in sessions use short-lived access tokens (15 minutes) and refresh tokens (7 days). Refresh tokens are stored only as hashes and can be revoked; deleting an account or signing out revokes them.
• Email sign-ups are verified with a one-time code sent to the address. You can also sign in with Google or Microsoft.
• Sign-in, sign-up, verification-code and password-reset endpoints are rate-limited to slow down password guessing.

Workspace isolation and roles

• Every request for workspace data is checked against the signed-in user's membership of that workspace, and queries are scoped to the workspace, so one customer cannot read another's data.
• Roles — Owner, Admin, Editor, Viewer and custom roles with per-page access — limit what each team member can do. Only Owners and Admins can connect or disconnect social accounts (Editors can switch which of an already-connected account's Facebook Pages it manages).
• Teams can further restrict which connected social accounts a member can see.

Connected social accounts

• Access tokens issued by Meta, TikTok and Google, and app secrets a workspace provides, are encrypted at rest with AES-256-GCM. They are used only by our servers and are never sent to the browser.
• Incoming webhooks from Facebook, Instagram, WhatsApp, Shopify, WooCommerce and EasyOrders are accepted only with a valid HMAC-SHA256 signature; OpenCart pushes must carry the store's secret token.
• Facebook, Instagram, TikTok, Google Search Console and Google Analytics connections use a single-use, server-side OAuth state value tied to the user and workspace that started them.
• Disconnecting an account deletes its tokens immediately and asks Meta to stop webhook delivery and withdraw our authorization. Requests Meta sends us when someone removes UniPulse from Facebook are verified and processed automatically. See Data Deletion.

Infrastructure

• UniPulse runs on servers hosted by Hostinger in France.
• The website, app and API are served only over HTTPS (TLS 1.2 or 1.3); plain HTTP requests to them are redirected.
• The database is backed up on a schedule; backups are encrypted and kept for 30 days on our hosting server.
• Application logs redact passwords, tokens and request query strings before they are written.

Internal access and monitoring

• Administrative access to the platform is limited to designated UniPulse staff, who use it to operate the service and provide support.
• Security-relevant actions — connecting and disconnecting social accounts, deleting workspaces and accounts, administrator edits to users and workspaces, and Meta data-deletion requests — are recorded in an audit log.
• Failures in key background processing, including Meta deletion requests, are surfaced to administrators, and unfinished deletion requests are retried automatically.

AI providers and other vendors

We send data to AI providers and other service providers only as needed to deliver the features you use. The Privacy Policy lists them and what each receives.

Incidents

If we become aware of a security incident affecting your data, we will investigate, contain it, and notify affected customers — and authorities and platform partners where required — without undue delay.

Reporting a vulnerability

Email support@unipulse.tech with "Security" in the subject line. Include the steps to reproduce the issue and its impact. Please give us reasonable time to fix it before disclosing it publicly, do not access or modify other customers' data, and do not run tests that degrade the service (such as denial-of-service). We will acknowledge your report and keep you updated.