How we handle transaction data.
We process transaction metadata to score behavioral deviation. Not card numbers, not raw PANs. This page describes what we have in place today and what is on the compliance roadmap.
How we protect what you send us.
These are engineering decisions we made at build time, not certifications we are working toward. Fraudpulsar scores behavioral deviation from transaction metadata. We do not accept, process, or store card instrument data.
All API communication is encrypted with TLS 1.3. TLS 1.0 and 1.1 are not accepted. Certificate validation is enforced. No plaintext API endpoints exist.
All persisted data, including per-account behavioral models and transaction event logs, is encrypted at rest using AES-256. Encryption keys are stored separately from the data they protect and rotated on a regular schedule.
Each customer's account model data and event logs are stored in isolated namespaces. A configuration error or breach in one tenant's environment cannot expose another tenant's data.
API keys are scoped to a single tenant and a single mode (test or live). A compromised sandbox key cannot access live data. Keys can be revoked instantly from your dashboard.
Fraudpulsar scores transaction metadata only. We do not accept, process, or store primary account numbers (PANs), card security codes, or any raw payment instrument data. The API schema does not have fields for these, by design. Keeping them out of scope is simpler and more secure than claiming we encrypt them.
Where we are and where we are going.
We use roadmap language for things we have not completed. We do not claim certifications we have not obtained. If you need a specific compliance statement for your procurement or legal team, email us directly.
We have designed our controls with SOC 2 criteria in mind: access control, availability, and confidentiality. Our formal Type II audit engagement is in planning for later this year. We will share the report with customers under NDA when complete. We do not claim SOC 2 certified today.
We do not store, process, or transmit raw PANs, so we are not in scope for PCI-DSS cardholder data environment requirements as a processor. Transaction metadata scoring does not trigger PCI scope. If your compliance team needs a statement, contact us directly.
A Data Processing Agreement (DPA) is available on request for customers subject to GDPR. Email [email protected] with subject line "DPA Request" and we will respond within two business days.
Responsible disclosure.
Found a vulnerability? Email [email protected] with a clear description and reproduction steps. We do not pursue legal action against good-faith researchers. We aim to acknowledge within 48 hours and confirm remediation scope within 5 business days.