Local document processing
Customer files are parsed in the browser. The platform does not need the complete raw document to calculate or save a compact workspace summary.
Security should constrain the product, not decorate the sales page.
VarePulse separates raw documents, deterministic calculations, AI interpretation, and human authority so each layer can be verified and limited.
Data minimisation
Saved records contain user-selected summaries, mappings, decisions, scenario parameters, and audit events—not the original spreadsheet payload.
Authenticated workspaces
Workspace pages use platform-managed sign-in. API writes require an authenticated identity and enforce ownership server-side.
Human approval boundary
Recommendations cannot become purchases or payments automatically. Approval Lock keeps operational authority with an identified user.
Payment isolation
Payment details are handled by the merchant-of-record checkout. VarePulse stores provider references and subscription state, not card numbers.
Auditability
Saved actions are attributed with timestamps and concise metadata so teams can review what changed without exposing unnecessary document content.
Implemented controls
Protect the highest-risk boundaries first.
- Signed-in identity required for workspace and billing writes
- Same-origin checks for state-changing browser requests
- Strict input size, plan, interval, and payload validation
- Prepared database queries and ownership predicates
- HMAC verification for Stripe and Paddle webhooks
- No payment API secrets exposed to the browser
- No automatic AI request on document upload
- Ambiguous SKU and stock mappings block analysis
- No automated purchasing or payment execution
Found a security issue?
Do not include customer data or exploit production accounts. Email support.varepulse@gmail.com or use the public contact form, choose “Security”, and include only the details needed to investigate safely.