Security

Last updated 30 September 2026

This page explains how Pulse by BigBoost protects the data it reads from Shopify, Meta and Google, who can reach it, and what we do if something goes wrong. What we collect is in our privacy policy.

How data is protected

• All traffic to and from Pulse uses HTTPS (TLS).
• Access tokens for Shopify, Meta and Google are encrypted in the database with a key for each brand, and are decrypted only on our servers when Pulse reads your data. Every decrypt is written to an audit log.
• Shopify access tokens expire after one hour and are renewed automatically. Disconnecting an account deletes its token straight away.
• Pulse does not request shoppers' names, email addresses or phone numbers from Shopify. Order data is reduced to totals for the brief.
• Stored data has fixed retention periods, listed in the privacy policy.

Who can reach it

• Only the BigBoost team members who run Pulse have access to production systems, and only for running and supporting the service.
• The administrator account on our production server accepts SSH keys only, never a password. Team accounts on our hosting, database and code services must use strong, unique passwords and two-step verification.
• Development and testing use a Shopify development store and sample data. Production store data is never copied into test systems.
• Access to production systems is logged.

If something goes wrong

This is our incident response policy.

• Detect and contain. Failures and unusual activity alert the operator. When we suspect an incident we act at once: revoke or rotate the affected keys and tokens, and stop the affected jobs.
• Assess. We work out what happened, which stores and which data were affected, and when.
• Notify. We tell affected merchants without undue delay and within 72 hours of confirming an incident that affects their data, with what happened, what data was involved and what we have done. We notify Shopify, Meta or Google when their data or platform is involved, and authorities when the law requires it.
• Fix and learn. We fix the cause, check nothing else is affected, and write down what changed so it does not happen again.

Report a security issue

If you find a security problem in Pulse, tell us through our contact page with the subject "Pulse security". We reply within two working days. BigBoost, Chennai, Tamil Nadu, India.