Security & trust

Our application, the edge that serves it, and our database run on Cloudflare's global network. The cloud-scale load, stress, TLS, and resilience tests run on isolated cloud infrastructure (AWS Fargate) — see our Subprocessors page for the full list. We lean on hardened, industry-standard infrastructure rather than rolling our own.

Payments are processed by Dodo Payments, our merchant of record. Your card details go to Dodo Payments, never to us: we store only a customer reference, a subscription reference and its status, which is all we need to keep your plan active.

Sign-in, passwords, and sessions are managed by Clerk, a dedicated authentication provider. We don't build or store password databases ourselves, which keeps the most sensitive part of any account out of our hands.

• All traffic to and from BCDRPulse is served over HTTPS/TLS.
• Secrets and API keys are held in managed secret storage, never committed to our code.
• Incoming payment webhooks are cryptographically signature-verified before we act on them, so forged events are rejected.

This is the principle BCDRPulse is built around. Every load test, stress test, and security scan runs only against an asset you've proven you control. Testing infrastructure you don't own can be unlawful, so we gate it behind verified ownership by design — it protects you, the people whose systems would otherwise be in the blast radius, and us.

See every product, and how each one works

We don't run advertising, analytics, or behavioural tracking, and we don't sell data. We collect only what's needed to operate the service — your account details, the assets you add, and the results we generate for them. You can read the specifics in our Privacy Policy.

We're a young product, and we don't yet hold formal certifications such as SOC 2 or ISO 27001 — and we won't pretend we do. What we can offer today is transparency about how we operate, sensible security practices, and a direct, responsive channel for anything that concerns you. As we grow, we'll invest in formal assurance and say so clearly when we have it.

If you believe you've found a security vulnerability in BCDRPulse, we want to hear from you. Email security@bcdrpulse.com, and see our Vulnerability Disclosure policy for what to include and what to expect.