Security

All communications between your browser and VitaPulse are encrypted using TLS (HTTPS). Passwords are hashed with bcrypt before storage — we never store plaintext passwords. Session cookies are configured as HTTP-only and SameSite to prevent cross-site attacks.

Your data is stored in MongoDB databases hosted in Europe. We collect only the minimum data necessary to provide the service: your email, hashed password, and scan results. Scan data belongs to you — we never use it for advertising, analytics, or any purpose other than delivering your audit results.

Every API endpoint is protected by authentication middleware. All actions are verified for ownership — you can only access your own projects and scans. Associate access is strictly limited to shared projects with read-only permissions on settings. Rate limiting protects all endpoints against abuse.

VitaPulse applies industry security best practices: HTTP security headers via Helmet (CSP, HSTS, X-Frame-Options), input validation and HTML escaping on all user inputs, CORS restricted to authorized domains, and rate limiting by endpoint category (authentication, scans, general API).