Security
Pulsar Deploy runs your apps and databases on infrastructure you control, with security built into every layer — from encrypted secrets and row-level security to isolated containers and a hardened host. Here's exactly how it's protected.
Found something? Email [email protected].
Secrets & data at rest
- ✓Environment variables are encrypted with AES-256-GCM before they touch the database, and are never printed in build logs.
- ✓Managed databases use strong per-instance generated credentials — no shared or default passwords.
- ✓Instance API keys are JWTs signed with a per-instance secret; rotating them instantly invalidates every previous key.
Row-level security for your users
- ✓Every table created in the editor ships with row-level security enabled by default.
- ✓Anonymous and signed-in end-users map to distinct Postgres roles; policies decide exactly which rows each can see or change.
- ✓Realtime change feeds honor the same policies — a subscriber only receives rows they are allowed to read.
Isolation & the build pipeline
- ✓Each deployment runs in its own container; edge functions run locked down (dropped capabilities, read-only root filesystem, memory/CPU/PID caps).
- ✓Platform data services (Postgres, Redis, object storage) bind to localhost only and are never exposed to the internet.
- ✓The public API is gated behind a per-instance switch (off by default) with a per-instance CORS allowlist.
Transport & the public surface
- ✓Automatic HTTPS on every site and API via Let’s Encrypt, with HSTS and hardened TLS.
- ✓Security headers everywhere: HSTS, X-Frame-Options, X-Content-Type-Options; server version banners disabled.
- ✓The host exposes only web (80/443), SSH, and managed-database ports; application processes are firewalled off from direct internet access.
Host hardening & operations
- ✓SSH is key-only (password authentication disabled); brute-force attempts are auto-banned.
- ✓Automatic security updates are enabled, and kernel-level network hardening is applied.
- ✓Managed databases are backed up nightly with retained snapshots and point-in-time restore.
Email integrity
- ✓Transactional email is DKIM-signed and sent from verified sending domains you control.
- ✓One-time codes are hashed at rest, single-use, and rate-limited to resist enumeration and brute force.
Read the docs or see the platform's live status on the status page.
Start deploying free