Security
EMpulse serves an index of street exchange rates. The only thing of value a customer entrusts to us is an API key, so the account is built around protecting that key, and we hold as little about you as a service can.
What we store, and what we do not
- Stored: the email your key was issued to, the key as a SHA-256 hash (never the key itself), your plan and invoices, request counts per key per day, and for the account: sign-in times, a salted hash of the network address, the country of the sign-in and a shortened browser name.
- Not stored: passwords (there are none), names, phone numbers, plain IP addresses, the contents of your requests beyond the endpoint and the period asked for.
- The market data itself contains no personal data. Details: the data processing addendum.
Sign-in without passwords
The account at /account opens with a one-time link sent to the email of your key. The link works once, for 15 minutes, and only from the network that requested it, so a forwarded or intercepted letter opens nothing. Sessions last 12 hours, are bound to your network address and use cookies marked Secure, HttpOnly and SameSite=Strict. A sign-in from a new network or country is announced by email.
Two-factor sign-in
Any account can add time-based one-time codes (TOTP, RFC 6238) from an authenticator app, with eight backup codes for a lost device. Enterprise accounts must enable it. Codes are asked only for the account, never for API calls — your integrations keep running unchanged.
Protecting the key
- Rotation. A new key is issued in the account and shown once; the previous one keeps working for 24 hours so an integration can switch, then stops. An emergency revoke stops it at once.
- IP lists. A key can be restricted to up to 20 addresses or CIDR blocks; requests from elsewhere are refused and you are told by email.
- Daily ceiling. You can cap a key below its plan limit, so a leaked key cannot spend your plan.
- Licence protection. Keys are personal; series served to each key may contain insignificant individual differences, and automated bulk download freezes the key. Nothing of this affects the published index values.
Encryption and hosting
Everything travels over TLS. Backups are encrypted (GPG) before they leave the server. Services run in a single EU data centre; access is limited to the operator with key-based authentication and a second factor.
Reporting a vulnerability
Found something? Write to security@empulse.ai. We answer within two working days, do not pursue good-faith research, and credit reporters who wish to be named. Please do not test with other customers' keys or data. Questions about the security of the service go to the same address; a lost account is a matter for hello@empulse.ai, from the email of your key.