Security

How Pulse protects your ad accounts

Pulse connects to advertising accounts that carry real budgets. These are the controls in place today.

Meta access

You connect through Meta's official OAuth flow. You sign in on Meta's page; Pulse never receives your Meta password.
Pulse requests read-only permissions: ads_read and business_management. It cannot create, edit or pause campaigns.
Pulse's Meta app credentials are held only on our servers. You never handle app IDs, secrets or access tokens.
Every Meta API call is signed with an app secret proof, so a leaked token alone can't be used through our app.

Meta access tokens are encrypted at rest with AES-256-GCM and decrypted only inside server-side sync jobs. They are never sent to your browser.
All traffic uses HTTPS. Data is stored in a managed PostgreSQL database in the United States.
Every workspace is isolated: each query is scoped to your workspace, and roles control who can view, sync or manage connections.

Passwords are hashed with bcrypt and never stored in plain text.
Sessions use secure, HttpOnly cookies. Changing your password or choosing "Sign out everywhere" ends all other sessions.
Sign-in, sign-up and password reset are rate limited. Meta connection flows are protected with single-use state values.
Security-relevant actions (sign-ins, password changes, Meta connections and disconnections) are recorded in an audit log.

Disconnect Meta from Settings → Integrations at any time. Syncing stops immediately, Pulse revokes its access in Meta and the stored token is destroyed.
You can also remove Pulse in Meta under Settings → Business Integrations. Pulse is notified and stops syncing.
To have your data deleted, use "Remove Meta data" in Integrations or email info@dive-digital.in.

If you believe you've found a security issue, email info@dive-digital.in. Please don't access data that isn't yours.