Encrypted in transit: all traffic between the app, our servers, and our subprocessors runs over HTTPS/TLS.
Encrypted at rest: your account data lives in Supabase's managed Postgres, which encrypts data at rest, with row-level security policies scoping every query to the signed-in user.
No password to steal: sign-in uses one-time email codes rather than a stored password.
Managed-only architecture: ChannelPulse has no bring-your-own-API-key mode — every AI/transcription/search call is routed and authenticated through our own backend, so a compromised client can't be used to exfiltrate a personal API key it never had.
Payments never touch our servers: Stripe handles and stores card details directly — we only ever see a subscription status, never a card number.
Privacy Mode: an opt-in toggle that excludes the floating notes window from screen shares/recordings and hides its dock/taskbar icon, for on-device privacy. See the Privacy Policy.
Our subprocessors' own security
We choose established providers for the parts of the stack that touch your data —
Supabase (database/auth/storage), Stripe (payments), OpenAI and Deepgram (AI/transcription),
Firecrawl (web research), and PostHog (analytics). Each maintains its own security program;
see the Privacy Policy
for what each one receives.
What's still on you
Keep your device and email account secure — since sign-in is by email code, anyone with
access to your inbox can access your ChannelPulse account. Keep the desktop app updated
(it checks for updates automatically) so you're always running the latest security fixes.
Report a security issue
Found a vulnerability? Please report it responsibly — email
edowilliams@gmail.com
with details and, if possible, steps to reproduce. Give us a reasonable window to
investigate and fix the issue before disclosing it publicly. We don't currently run a
paid bug-bounty program, but we'll credit responsible reporters if they'd like.