Security

This page explains how PulSound protects your files and your account, and how to report a security problem.

Your files stay on your device

• Audio, video and photos you open in the studio, the video editor and the tools are processed by your browser. They are not uploaded to our server.
• Exports are made in your browser and saved straight to your device.
• Studio and editor projects are kept in your browser's storage. To keep a copy, save the project as a file (.pulsound) and store it wherever you like.
• AI models are downloaded to your browser the first time you use an AI feature, and then run on your device. Your files are not sent to the model hosts.

What is stored on the server

Only what you publish or need for your account: your email, a password hash, release and link pages you create, their covers and links, and page view and click statistics. The full list is in the Privacy Policy.

How accounts and the site are protected

• HTTPS everywhere, with HSTS.
• Passwords are stored only as bcrypt hashes.
• Limits on login attempts, and bot protection (Cloudflare Turnstile) on forms.
• Protection against cross-site request forgery on every form.
• A strict Content Security Policy and other security headers.
• Optional two-step sign-in with a code sent to your email.
• The site runs behind Cloudflare.
• Dependencies are checked for known vulnerabilities and updated regularly.

Report a security problem

If you find a vulnerability, please write to pulsound.com@gmail.com with “Security” in the subject. Describe the problem and the steps to reproduce it. Please do not access other people's data, disrupt the service or make the problem public before it is fixed. We will reply as soon as we can. Machine-readable contact: security.txt.

Good to know

PulSound is in beta. We work hard to keep it safe, but no online service can promise to be free of errors. Keep copies of your important projects and exports on your own device. Details are in the Terms of Use.