Security & your data
The secrets you give us stay secret.
Last updated: September 26, 2026
Monitoring real services often means handing over a credential — an API key, a token, a database password. CuliPulse encrypts those at rest, never shows them back to you, and is built to carry them to as few places as possible.
Encrypted at rest, and write-only.
When a check needs to authenticate, the secret you enter is encrypted before it's stored — and once saved, it's never shown again or returned by our API. You see the header's name, not its value; to change it, you re-enter it.
Auth credentials (Bearer tokens, Basic username/password), API keys you add as secret headers, request bodies, and TCP/UDP payloads you mark sensitive are encrypted with AES-256-GCM before they touch our database — and so are Slack and webhook addresses and webhook signing secrets.
After you save a secret, the dashboard and API return only that it's set — never the value. Replace it any time by typing a new one; leave it blank to keep the stored one.
Your secrets don't wander.
A saved secret is decrypted only inside CuliPulse and by the checking agents we run ourselves, to actually run your check. Agents you run yourself never receive your saved secrets, and neither does any other customer's agent. If you save a monitor that has secrets and runs from your own agent, CuliPulse warns you, since that check runs without them.
The small helper you run for private checks only ever connects outward to CuliPulse. It opens no inbound ports and exposes nothing to the internet.
Sign in with an identity you already trust.
You sign in with Google or GitHub over OAuth — that's the only way in. There's no CuliPulse password to set, so there's none for us to store.
Sessions are cryptographically signed (HMAC-SHA256). The session cookie uses the browser-enforced “__Host-” prefix and is HttpOnly, Secure and SameSite=Lax.
Agents and API clients authenticate with tokens — and we store only a SHA-256 hash of each. API tokens are scoped to read or read-and-write, and rate-limited.
Everything between you, our network, and your agents travels over TLS (HTTPS).
Built-in safeguards.
Every webhook we send carries an HMAC-SHA256 signature in the X-CuliPulse-Signature header, so your endpoint can check it really came from us.
CuliPulse's shared agents won't connect to a private, loopback or link-local address — not when you save a monitor, not when a site redirects, and not if its address changes later. Private hosts are meant to be checked by an agent you run yourself.
Report pages ask search engines not to index them and don't pass your address on to other sites. Delete a report to switch its link off.
Solid engineering hygiene — and we'll be precise about it.
CuliPulse holds the encryption key, because we have to decrypt a secret to run your check with it — so we can read it for the moment a check runs, and we won't pretend otherwise. We also don't hold a formal third-party security audit or certification. What we do offer is the care a thoughtful engineer takes with credentials you've trusted us to hold: encrypted at rest, write-only, and kept to as few places as possible. We'd rather tell you exactly that than dress it up.
Have a security question, or need to talk through your requirements for procurement? Email support@culipulse.dev.