Security
How AppsPulse protects your store credentials, bot tokens, and app data.
Encrypted credentials
Store credentials — Google service account keys, App Store Connect API keys, and OAuth tokens — are encrypted with AES-GCM before they are stored. They are decrypted only on our servers when a sync runs and are never sent back to your browser in plaintext.
Telegram bot tokens and webhooks
Telegram bot tokens are encrypted the same way. Every bot binding has its own webhook secret, and AppsPulse only accepts updates that carry the secret for that specific binding.
Read-only capability checks
When you connect a credential, AppsPulse checks what it can access using read-only API calls. Nothing in your developer accounts is changed during setup.
Access control
Each workspace has owner, admin, member, and viewer roles, and access can be granted per product. Members and viewers only see the products they have been granted.
Hosting
The AppsPulse application and APIs run on Cloudflare's global network with built-in DDoS protection. All connections use HTTPS, and AI features run on Cloudflare Workers AI.
Your data, your control
You can disconnect a platform or delete your account at any time. Associated data is deleted within 30 days, as described in our Privacy Policy.
Reporting a security issue
If you believe you have found a security vulnerability, please email support@appspulse.org with the subject "Security" and details to reproduce it. Please do not disclose it publicly until we have had a chance to respond.