Controls
The controls behind every session.
Mandatory 2FA
Every interactive account enrols an authenticator app. No role is exempt, and recovery codes are single-use and stored hashed.
Step-up verification
Credential changes, permission changes and recovery actions require a fresh authenticator code.
Least privilege
People see only the resources explicitly assigned to them, enforced in the database itself.
Dedicated secret storage
Credentials sit behind a secret boundary with no reveal, copy or export path in the product interface.
Destination checks
A launch is bound to one exact approved destination, and authorization expires in seconds.
Audit without secrets
Sign-ins, launches, rotations and assignment changes are recorded — secret values never are.
Accuracy statement
What we will not claim.
Hiding a password in the interface is not the same as making it technically impossible to extract. A browser-delivered credential can be recovered by a sufficiently privileged user on their own device. PulseHireX reduces exposure, controls who can launch what, and records the event. Brokered Access, for cases where the credential must never reach the endpoint, is in development and not yet available.
Questions
Security questions buyers ask first.
Does PulseHireX show passwords to team members?
No. The team interface has no reveal, copy or export action. Administrators write and rotate secrets; they are not displayed back afterwards.
What happens when a client website requires its own MFA?
PulseHireX never bypasses third-party MFA, CAPTCHA or anti-bot controls. The user completes the client's own second factor after the controlled sign-in.
What happens when an employee leaves?
Authorized company administrators review and confirm access removal with an audit trail. Accounts and historical records are preserved; automatic handovers remain release-gated.
How do you handle responsible disclosure?
Report a suspected vulnerability through the contact page and it is routed to the security owner for triage.
Review the architecture with your security team.
We will walk through authentication, launch authorization, the extension model and the brokered boundary.