Security

Before you process sensitive documents in production, check how Pulse protects your documents and results, and how long it keeps them.

How Pulse handles your data

Area	What Pulse does
Model training	Pulse doesn’t use your documents to train models.
Access	Your jobs, results, saved configs and webhooks belong to your organization. Any of your organization’s API keys can read them; no other organization’s keys can.
File links	Pulse downloads a `file_url` without credentials, so it reads only what anyone with the link can download. It refuses links to private and internal network addresses, and checks each redirect before following it.
PDFs	Pulse removes JavaScript and other active content from a PDF before it stores or processes the file, and refuses a PDF it can’t make safe.
Results	API responses carry no public download links. A member of your organization can share a saved parse from the dashboard as a public link, which anyone with the link can open.
Webhooks	Each webhook delivery is signed and names only the event, the job’s id and its endpoint, never document content or results.

To keep your API keys safe, call Pulse only from your server.

Retention

By default, results don’t expire. These cases are the exceptions:

What	When it expires
A parse sent with `config.storage.save: false`	24 hours later.
Every Parse, Extract, Split and Tables result, and every pipeline result, when your organization has turned saving off	24 hours later.
Every result, when your organization’s retention is 1 hour or 24 hours	1 hour or 24 hours later. This replaces both cases above.

The clock starts when Pulse accepts the request, except for Extract, whose clock starts when the job ends. A batch’s jobs and a pipeline’s steps count from when the batch or pipeline ends. Your organization can also have each result deleted the first time it’s read. In that case, a failed job’s document and files are deleted when it fails.

Where results are deleted on first read, a step can’t read a parse whose result you’ve already read. Let every step on a parse finish, or run them in a pipeline, before you read the parse’s result.

Retention covers everything a job creates: its result, its files, and the copy of the document Pulse stored. The API has no route that deletes a result: DELETE on a job only cancels it, while it’s queued or processing. To change your organization’s retention, contact support.

Compliance

Pulse’s trust, security and compliance documentation is in the Trust Center.

SOC 2

Audited controls for security operations.

ISO 27001

Information security management controls.

HIPAA

Healthcare data, when your agreement covers it.

GDPR

Privacy controls for EU personal data.

Which commitments apply to you depends on your agreement.

Get started

Endpoints

Run at scale

Essentials

Account

How Pulse handles your data

Retention

Compliance

SOC 2

ISO 27001

HIPAA

GDPR

​How Pulse handles your data

​Retention

​Compliance

SOC 2

ISO 27001

HIPAA

GDPR

How Pulse handles your data

Retention

Compliance