How we protect your data.

What we will never do

Security pages describe controls. Controls change. These do not — they are the reason the controls exist, and we will write every one of them into your contract.

1. What data we receive

2. Architecture

The shape of the system is itself a security decision. The most reliable way to protect data is not to hold it.

• • On-prem agent — a ~200-line Python script using only the standard library. It runs inside your network, polls your FlexLM / RLM / Sentinel daemon every 5 minutes, and pushes summary records out over HTTPS. It opens no inbound port, accepts no commands, and has no remote-execution path. Your firewall needs no new inbound rule. Ask us for the source and have your security team read all of it.
• • Outbound only — every connection is initiated from inside your perimeter. We never connect in.
• • Read-only by construction — the agent runs the license daemon's status command. It cannot check out, release, or reserve a license, and it cannot change your license server's configuration.
• • Per-tenant isolation — every database query is scoped by org_id. There is no cross-organisation query path in the application.
• • Three ways in, all of them yours to choose — the agent, read-only OAuth for SaaS seats, or a file you upload. You are never required to grant OAuth to use the product; the engineering path needs no credentials of yours at all.

2. Where your data lives

• • Application + database: Render.com, US Oregon region. Render is SOC 2 Type II attested.
• • Database: PostgreSQL managed by Render, encrypted at rest by default.
• • Customer-uploaded contract documents: stored as binary blobs in the same Postgres instance.
• • AI classification: file metadata + small content samples sent to Anthropic (Claude). Anthropic does not retain or train on your data.
• • No data leaves these providers. No third-party analytics, ad networks, or unmanaged servers.

3. Encryption

4. Access controls

• • Authentication — email + password, JWT-based session tokens. TOTP MFA available today. SSO (SAML/OIDC) is on the roadmap, not shipped — see below.
• • Authorization — three roles: Owner, Admin, Viewer. Multi-tenant isolation by org_id on every database query.
• • Internal access — production access is held by the smallest number of operators the service can run with, under least privilege. There is no shared administrative account and no support back door. Every access is logged.
• • API keys — scoped to a single organization, revocable instantly.
• • Audit log — append-only. Every login, change, key event recorded. Owners and Admins can export to CSV.

5. Data processing & privacy

You are the controller. We are the processor. That is not a formality — it decides who gets to make decisions about your data, and the answer is you.

• • DPA with EU Standard Contractual Clauses — available on request, signable before you send us anything. Read it here.
• • Purpose limitation — your data is used to operate the service for you. It is not used to build products for anyone else, and it is not used to train models.
• • Retention — active for the term, then 30 days to export, then deleted from active systems within 30 days and from backups within 90 as they age out. Written confirmation of deletion on request.
• • Data subject requests — export, correction, and deletion are self-serve in the app. Where they are not, we handle them within 45 days.
• • Delete on demand — you do not have to wait for a term to end. Ask and we delete.
• • Sub-processor changes — at least 14 days' advance notice, always.

6. Responsible AI

LicensePulse uses a language model in two narrow places: classifying the columns of a file you upload, and answering questions about your own portfolio in the assistant. Here is exactly what that means.

• • What is sent — file metadata and small content samples for classification; your portfolio summary figures for the assistant. Never your contract PDFs in bulk, never raw daemon logs wholesale.
• • Who processes it — Anthropic, under a data-processing agreement. Your data is not retained by them and is not used to train models.
• • The model never decides anything on its own. It classifies and it summarises. Every figure it reports comes from your data in our database — it does not estimate, and it is not asked to.
• • Show your work — where the assistant states a number, you can open the underlying product and see the check-out records it came from. A number you cannot trace is a number you cannot defend in a negotiation, which makes it worse than no number.
• • It says when it does not know. We would rather return "the data does not cover that period" than a confident answer built on a gap.
• • No AI-driven decisions about people. The model is never used to evaluate, rank, or score an individual employee. See what we will never do.
• • You can turn it off. The assistant and AI classification can be disabled for your organisation; the rest of the product works without them.

7. Sub-processors

A small, deliberately narrow set of vendors. Each is bound by a written data-processing contract.

We give customers at least 14 days' advance notice of any new sub-processor. Subscribe by emailing privacy@licensepulse.app.

8. Incident response

• • Documented incident-response playbook with defined severity levels.
• • Affected customers notified within 72 hours of confirmed discovery (GDPR-aligned, faster than CCPA's "without unreasonable delay").
• • Notification: email to primary contact + in-app status banner.
• • Post-mortem with root cause + remediation plan within 14 days.

Report a vulnerability: security@licensepulse.app. We respond within 5 business days and credit responsible disclosure publicly.

9. Backups & disaster recovery

A backup is not a backup until you have watched the data come back. Restore drills run quarterly from launch — we do not claim a drill history we do not have.

10. Compliance posture

11. Company & continuity

LicensePulse is a software company building measurement tools for engineering software licensing. Our contracting entity is named in the Terms of Service, the Privacy Policy, and the DPA — the documents your procurement team will actually sign. More about why we built this.

We are a small team, and we will not pretend otherwise in a security review. Concentration risk is a fair question to ask a company at our stage, so here is how we answer it:

• • You reach people who build the product. Support is not a tier that filters you away from the engineers. A bug reported on Tuesday is not queued behind a roadmap.
• • We do not run a 24/7 on-call rotation. If production breaks overnight in your timezone, it may be some hours before we respond. We would rather say that than sell a service level we cannot measure.
• • You are never trapped. Everything exports at any time, in a documented open format that works without us — your data, your usage history, your evidence packs. If we were to disappear tomorrow you would still walk into your renewal prepared. That is the real answer to the continuity question, and it is why the export commitment above is unconditional.
• • Escrow — for enterprise agreements we will arrange source and data escrow. Ask.

12. Security roadmap

What is shipped, what is not, and what we will do when asked. Nothing in the "planned" column is being sold as though it exists.