Security

• Read-only. Agency Pulse only reads from your CRM. It can't send messages, edit contacts or change automations.
• Minimal data. We never store message text or your clients' customers' names, emails or phone numbers — only counts, times, IDs, statuses and amounts.
• Encrypted tokens. CRM access tokens are encrypted at rest with AES-256-GCM. All traffic uses HTTPS.
• Verified webhooks. Every event from the CRM is checked against its digital signature before we use it.
• Agencies are isolated. Every query is limited to your agency, and automated tests check that one agency can never see another's data.
• Signed sign-in. Inside the CRM, your identity comes from the CRM's encrypted user context; email links that sign you in expire after a few days.
• Private report links. Hosted client reports use long random links that stop working after 180 days.
• Safe uploads. Logos are checked by content and re-encoded, so nothing hidden in a file is ever stored or shown.
• Deletion. Disconnect and your data is deleted after a 30-day export window.

Report a problem

If you think you've found a security issue, email hello@goldstandardweb.com. We reply within 24 hours and fix confirmed issues quickly.