Trust & security
How we protect your data, and who we work with.
Your data
What we keep, and what we don't.
Each product keeps what it needs to work. The privacy policy lists every item and how long we keep it.
On websites that use Pulse
We keep
- Which pages were viewed, and the site or campaign a visitor came from
- Country, region and city, unless the site owner narrows it
- Device type, browser and operating system
- A visitor hash that changes every month, so a reader who comes back that month counts once
- A short code for spotting bots, deleted after 14 days
Never
- Cookies
- IP addresses
- Anything you type
- Anything that follows a person to other sites
For your Ciphera account
We keep
- A sign-in record that is not your password
- A vault with your name and email address, which only your browser can open
- A copy of your email address that our mail service can read, so it can write to you
- A log of sign-ins and security changes, with IP addresses hashed, kept for 180 days
Never
- Your password, or a hash of it
We don't use Google or Meta tracking, ad networks, data brokers or outside CAPTCHA services, and our emails carry no tracking pixels.
Where it runs
Every company we work with.
The servers that store your data are in Zurich, with off-site backups elsewhere in Switzerland.Every request reaches them through bunny.net, which also hosts this website. Connections are decrypted on bunny.net's servers on the way in, so bunny.net handles the full requests, IP addresses included.
- Company
- Exoscale
- What we use it for
- Our servers, databases and file storage
- What it sees
- Everything we store
- Where
- Switzerland
- Company
- Infomaniak
- What we use it for
- Off-site backups and our domain name
- What it sees
- Backup copies of our data
- Where
- Switzerland
- Company
- bunny.net
- What we use it for
- Content delivery, DNS, DDoS protection, and hosting for this website
- What it sees
- Every request, including IP addresses
- Where
- Slovenia, servers worldwide
- Company
- Mollie
- What we use it for
- Payments
- What it sees
- Billing and subscription details
- Where
- Netherlands
- Company
- GitHub
- What we use it for
- Our source code
- What it sees
- Code, no personal data about you
- Where
- United States
- Company
- Let's Encrypt
- What we use it for
- Security certificates
- What it sees
- Our domain names, no personal data
- Where
- United States
- Company
- Linear
- What we use it for
- Our internal work tracker
- What it sees
- Technical notes, no personal data about you
- Where
- United States
That is the whole list. We have a data processing agreement with each company that handles personal data.
- Services you connect yourself, such as Google Search Console, are not on it.
How sign-in works
Your password never leaves your device.
Signing in to Ciphera uses a protocol called OPAQUE. Your browser proves that it knows your password without sending it to us.
When you sign up, your browser creates a record that we store. It contains neither your password nor a hash of it. The key needed to test password guesses against that record is kept apart from the database, so a stolen copy of the database is not enough to start guessing.
| Your password | Your name | Your email address | |
|---|---|---|---|
| You, in your browser | Can read | Can read | Can read |
| Our mail service | Can't read | Can't read | Can read |
| Our sign-in server | Can't read | Can't read | Can't read |
Your name and email address are sealed in a vault that only your browser can open. Our mail service keeps its own encrypted copy of your email address, so it can send you verification codes and security alerts. The sign-in server can read neither.
We can't reset your password, because we never have it. Your 24-word recovery phrase gets you back in. Accounts from before 7 September 2026 set one up from Security settings. If you lose your password with no recovery phrase enrolled and no passkey, the account cannot be recovered.
Once you are in, apps get an access token that lasts 15 minutes, and the refresh token behind it changes every time it is used. Repeated wrong passwords lock the account for 15 minutes, then an hour, then a day.
What our sign-in server stores about you
opaque_record- The sign-in record your browser created.
opaque_wrapped_key- The key to your vault, locked with a key your browser derives from your password.
encrypted_vault- Your name and email address, sealed on your device.
email_blind_index- A keyed fingerprint of your email address, used to find your account.
Open source
What is public.
You can read the script Pulse runs on websites, the Pulse dashboard, and the cryptography behind our sign-in.
- TesseraThe library behind our sign-in, with SDKs for Go and the browser. It builds on opaque-ke, Meta's OPAQUE library.Apache-2.0 (opens in a new tab)
- Pulse dashboard and trackerThe app our customers use, and the script that runs on their websites.AGPL-3.0 (opens in a new tab)
- Pulse CLIYour analytics from the terminal, with the API client and types it uses.Apache-2.0 (opens in a new tab)
- 14 integrationsPulse for Astro, Nuxt, Framer, Drupal, Joomla, TYPO3 and more.Mostly Apache-2.0 (opens in a new tab)
- This websiteThe code behind ciphera.net, this page included.AGPL-3.0 (opens in a new tab)
- 25 public repositoriesgithub.com/ciphera-net (opens in a new tab)
Check it yourself
The tracker your visitors load is byte for byte the file in our public repository.
curl -s https://- Tessera has a published self-audit and threat model. No independent firm has audited it.
- We hold no SOC 2 or ISO 27001 certification.
Security reports
Found a security problem? Tell us.
Email security@ciphera.net. Tell us what is affected, how to reproduce it and what you think the impact is, and whether you'd like to be credited.
Where to write
We reply
Within 3 business days
First assessment
Within 7 days
Fixes
In order of severity, with updates as we go
Credit
Public, after the fix ships, if you want it
In scope
- Every site under *.ciphera.net
- Our public repositories on GitHub
Out of scope
- Denial of service
- Social engineering
- Problems in other companies' services (please report those to them)
We won't take legal action against anyone who reports in good faith and follows this policy: don't access more data than you need to show the problem, don't disrupt the service, and give us reasonable time to fix it before you publish.
We don't run a paid bug bounty.
We don't publish a PGP key. If your report is too sensitive for plain email, say so, and we'll set up a secure channel.
We report what we find in other people's software too. In July 2026 we reported a server-side request forgery in besticon, an open-source favicon service, which was fixed in September. Read the advisory (opens in a new tab)
Running a vendor review?
Last updated 17 October 2026.