Pulse ProtocolPrivate test version. Pulse Protocol is not open to the public yet: access is for testing and early access, by invitation only, and nothing is sold. It is operated by a company currently being incorporated in the Seychelles; its registration details will be published before any public commercial launch. The legal documents on this site are drafts that are not in force.
Security
What Pulse holds, what it can do with it, and what happens when something breaks. Including the parts that are not reassuring.
Your API keys
- Keys are encrypted at rest. The master key is kept in a server configuration file that only the system administrator can read, outside the application's data directory, and is handed to the service when it starts.
- A key is never displayed again after you save it, never written to a log, and never sent to your browser.
- Pulse asks for trading permission only. It never asks for withdrawal or transfer rights, and it has no code path that could use them.
The protection you control yourself: create the API key without withdrawal permission, and enable your exchange's IP whitelist if it offers one. A key configured without withdrawal permission does not allow Pulse to make a withdrawal. Always check the permissions directly with your exchange: that is where they are set, and the only place they can be confirmed.
Your account
- Sign-in asks for a password and, once two-factor authentication is on, a six-digit code from your authenticator app. Two-factor is not optional for live trading: Pulse refuses to enable real trading until it is on.
- Changing your password requires the current one plus a fresh 2FA code.
- Sessions expire, and signing out ends the session on the server, not only in the browser.
When Pulse is down
This is the question that matters, so here is the direct answer.
- Orders already placed at the exchange, including stops, are unaffected. They live at the venue, not with us. Your positions do not depend on our servers to be closed at their stop.
- Stops held in the monitor do depend on us. Some stop types cannot be placed at the exchange in advance. Pulse labels those positions watched-only, in plain words, precisely so you know which protection travels and which does not.
- A separate process checks the terminal every five minutes, because a dead service cannot report its own death.
What we do not claim
Pulse Protocol has not undergone an independent third-party security audit or penetration test. When it does, the report will be linked here. Until then, please size your exposure with that in mind.
Found something? Write to stephan@pulseprotocol.co with "security" in the subject. We will confirm receipt and tell you what we are doing about it.