Security
What we do with your data, stated plainly
Pullsy holds data your customers own, on their instructions. This page is what we would want to read before trusting somebody else with it — practices you can verify, and the full list of services involved.
How it works
Credentials are never yours to hold
Account owners authorize through the platform's own OAuth flow. No password reaches you or us. Access and refresh tokens are encrypted at rest, and disconnecting an account wipes them immediately — the data you already pulled stays, the ability to pull more does not.
One organization cannot see another
Tenancy is enforced in the data layer rather than remembered by each query. Reads are scoped to the caller's organization by construction, and a static check fails the build if a query is written without that scope.
Workspaces separate your clients
Inside an organization, each workspace holds its own connections and data. An API key belongs to one workspace and cannot reach another, so a key handed to a contractor reaches exactly one client's data.
Keys are hashed, scoped and revocable
An API key is shown once and stored only as a SHA-256 hash. Each carries the narrowest useful scopes — data:read, sync:write, connections:write — can be given an expiry, and can be revoked without disturbing any other integration.
Roles limit what a member can do
Invite a strategist to read the numbers without granting the ability to connect or disconnect accounts, manage members, or change billing.
Actions are recorded
Connection lifecycle events, member and role changes and key creation are written to an audit log, so a question about who connected what has an answer.
The current list is available on request
We keep a list of every service that processes data on our behalf, and we will send it to you — named, with the purpose and region for each — under NDA if you want one. It is not published here on purpose: a public inventory of our infrastructure is a map for somebody probing it, and it buys a reader nothing that an emailed copy does not.
What the list covers
Every category of processing: where application data is stored, where the services run, who processes payments, who sends transactional email, and the platforms the connected data itself comes from.
How to get it
Email legal@getpullsy.com and say who you are. We answer these the same week, and we will sign a mutual NDA first if your process requires it.
When it changes
The list is kept in step with what the code actually talks to. If you are an active customer and a sub-processor changes, you are told rather than left to re-request it.
What is public
The categories of recipient, and your rights over the data, are set out in the privacy policy — which is the document that binds us, and the one your reviewer should read first.
Request it from legal@getpullsy.com, or read the privacy policy.
What we do not claim
A security page that only lists strengths is not a security page.
- Pullsy holds no SOC 2 or ISO 27001 certification today. When that changes, this page will say so with a date and a report you can request.
- Data is stored in the United States, with payments processed in India. If your obligations require a specific region, tell us before you trial rather than after.
- We are the processor for the platform data you connect, and the controller only for your account and billing details. A request about an end user's data goes to the business that connected the account first.
Reporting something? Write to privacy@getpullsy.com. The full detail is in the privacy policy.
Bring it to your reviewer
Everything on this page is checkable from the product itself. Start a trial and check it.