Monitoring real services often means handing over a credential — an API key, a token, a database password. CuliPulse encrypts those at rest, never shows them back to you, and is built to carry them to as few places as possible.
When a check needs to authenticate, the secret you enter is encrypted before it's stored — and once saved, it's never shown again or returned by our API. You see the header's name, not its value; to change it, you re-enter it.
Auth credentials (Bearer tokens, Basic username/password), API keys you add as secret headers, request bodies, and TCP/UDP payloads you mark sensitive are encrypted with AES-256-GCM before they touch our database.
After you save a secret, the dashboard and API return only that it's set — never the value. Replace it any time by typing a new one; leave it blank to keep the stored one.
A secret is decrypted only by CuliPulse's own checking network and the agents you enrolled — to actually run your check. It is never handed to another customer's agent.
The small helper you run for private checks only ever connects outward to CuliPulse. It opens no inbound ports and exposes nothing to the internet.
You sign in with Google or GitHub over OAuth — that's the only way in. There's no CuliPulse password to set, so there's none for us to store.
Sessions are cryptographically signed (HMAC-SHA256). The session cookie uses the browser-enforced “__Host-” prefix and is HttpOnly, Secure and SameSite.
An agent authenticates with a token — and we store only a SHA-256 hash of it. The raw token is never written to our database.
Everything between you, our network, and your agents travels over TLS (HTTPS).
CuliPulse holds the encryption key, because we have to decrypt a secret to run your check with it — so we can read it for the moment a check runs, and we won't pretend otherwise. We also don't hold a formal third-party security audit or certification. What we do offer is the care a thoughtful engineer takes with credentials you've trusted us to hold: encrypted at rest, write-only, and kept to as few places as possible. We'd rather tell you exactly that than dress it up.
Have a security question, or need to talk through your requirements for procurement? Email support@culipulse.dev.