ViolationPulse

Security

Isolation enforced where it counts.

Access control that lives only in the interface is not access control. ViolationPulse enforces separation in the database itself.

Tenant isolation in the database

Every customer record carries an organization identifier, and access is enforced by PostgreSQL row-level security policies — not only by application code. A user of one organization cannot read another organization's data even if application logic were bypassed.

Least-privilege access

Database roles are granted the minimum required privileges, down to individual columns. Anonymous access to customer tables is revoked entirely, and privileged operations run through audited, tightly-scoped functions.

Role-based permissions

Owner, admin, member and viewer roles are enforced at the database level. An admin cannot promote themselves to owner, and an organization can never be left without an owner.

Encrypted credentials

Third-party credentials and access tokens are encrypted at rest with authenticated encryption. They are never written to logs, error reports or analytics.

Secrets handling

Server-side keys exist only in server environments. Request URLs and query strings that could carry credentials are redacted before anything reaches logs or error monitoring.

Audit trail

Sensitive actions — campaign activation, mailbox connection, plan changes, member changes, administrative overrides — are recorded with the actor and timestamp.

Email safeguards

Opt-outs are stored permanently and cannot be removed by deleting a campaign. Sequences stop on replies and unsubscribes, both re-checked in the second before each message goes, and outreach is blocked entirely without a configured business postal address. A message the receiving server refuses outright is recorded as failed; a bounce that arrives later, as its own message, is not yet detected.

Tested, not asserted

Cross-tenant isolation, role escalation attempts and privilege configuration are covered by an automated test suite that runs against a real database and API layer in continuous integration.

Reporting a vulnerability

If you believe you have found a security issue, contact us through the contact page with the details. We investigate every report and will acknowledge receipt.