1. Overview
- Message keys remain on client devices in sealed production modes.
- Identity, authentication, and payment confirmation run on our EU origin.
- Managed routing processes sealed payloads and the metadata needed for delivery.
- Marketing-site providers are documented separately in the Privacy Notice.
2. Separation of responsibilities
Account, directory, authentication, and payment-confirmation records are held on the EU origin operated for OpenPulse. Application data remains with the integrator unless a separate managed service expressly stores it.
Relays route traffic. They are not intended to become a second identity or payment-trust system.
3. Encryption
Production traffic is sealed end to end when configured. Operators see opaque bodies and routing metadata, not message plaintext. Demo and staging environments may use plaintext modes for debugging; those modes are not production privacy claims.
Messaging targets established protocols for one-to-one and group sessions. Transitional modes remain labelled until production ratchets are complete.
4. Sign-in and wallets
Passkeys and sign-in terminate on the OpenPulse Auth service. Apps such as openpulse.org and pay.openpulse.org sign in with the standard authorization-code flow (PKCE) and keep the session in an encrypted, HTTP-only cookie; page scripts never see a token. Refresh tokens rotate on every use, and reusing an old one ends that sign-in and is shown in your security activity. You can see and sign out every place you are signed in from your identity page.
Pulse Pay wallets are self-custodied smart accounts. Each wallet is controlled by its own passkey on your device; OpenPulse stores only public key material and cannot move funds, reverse a payment or recover a wallet. An optional recovery phrase, held only by you, can add a new passkey to the same wallet. Payments count as done only when the transfer is on the blockchain.
5. Subprocessors
Every provider that processes personal data for OpenPulse:
| Processor | Purpose | Data processed | Region | Status |
|---|---|---|---|---|
| Hetzner Online GmbH | Hosting in Helsinki | Everything OpenPulse stores | EU (Helsinki) | Core |
| Stripe Payments Europe, Ltd. | Billing and payments | Billing name, email and address, VAT ID, payment method, invoice amounts, monthly usage totals per organisation | EU (Ireland), US group | Core (billing) |
| Resend Inc. | Email address, message content, delivery status | EU (Ireland), US company | Leaving (OpenPulse Mail on Amazon SES) | |
| Amazon Web Services EMEA SARL | Email delivery (OpenPulse Mail) | Email addresses, message content and attachments, delivery status | EU (Ireland), US group | Core (mail delivery) |
| Circle (Circle Internet Group, Inc. and affiliates) | Pulse Pay wallets (test network) | Passkey public key and credential ID, passkey display name (your @handle and wallet label), wallet address, signed wallet operations, IP address and browser details of wallet requests | US | Test network |
| Base (Coinbase Technologies, Inc.) | Blockchain reads | Wallet addresses and transaction hashes that our servers look up | US | Replaceable (any Base node) |
Register updated 2026-10-13. The Privacy Notice lists the same providers.
6. Data categories
OpenPulse processes handles and account bindings, claim and verification email, session bindings, public identity and encryption material, sealed traffic, routing metadata, security events, meeting audio and video (and recordings, when a meeting is recorded), Pulse Pay wallet public keys and addresses, and payment records.
The legal bases, retention criteria, recipients, international-transfer safeguards, and data-subject rights are set out in the Privacy Notice.
7. Customer controls
Integrators can self-host relays, restrict traffic with realm keys, revoke credentials, and require sealed production modes. Public performance and capacity statements apply only where the corresponding published validation gate has passed.
8. Security contact
Report vulnerabilities privately to security@openpulse.org. Include the affected service, a concise reproduction, and the likely impact. Do not include unnecessary personal data or publish an active exploit before remediation.
This disclosure channel covers the OpenPulse wire, Auth, Pay Checkout, and official managed relays. OpenPulse does not currently claim a public bug-bounty programme.