Terms of service

PulseVault is a hosted application-secrets management service, accessible through a web dashboard, an HTTP API and a command-line client. It is published by Kévin Aubrée, sole trader (french micro-entreprise), based in Villeneuve-d'Ascq (59491), France.

Using the service, including joining the waitlist, constitutes full acceptance of these terms.

• Service: all storage, retrieval and traceability features provided by PulseVault.
• User: any natural person accessing the service.
• Organisation: the workspace grouping members, projects and environments.
• Secret: an encrypted name/value pair stored in an environment of a project.
• Token: a machine authentication credential, personal (pvp_) or read-only service token (pvs_).

Creating an account requires a valid email address, verified by a one-time code. You undertake to provide accurate information and to keep your credentials and tokens confidential.

Any action carried out from your account or with your tokens is deemed to be yours. If you suspect a compromise, immediately revoke the tokens concerned from the dashboard, change your password and notify us at [email protected].

The organisation administrator is responsible for the access granted to members and for revoking it when no longer justified.

The service stores your secrets encrypted and returns them to the people and machines you authorise, with a hash-chained audit log. The command-line client injects those values as environment variables when your processes start.

The publisher is bound by an obligation of means. The service is provided as is, with no guarantee that its features will meet all your needs or that it will operate without interruption or error.

The publisher may change the features of the service. Changes materially unfavourable to subscribers will be announced with reasonable notice.

The service offers a free tier and paid subscriptions whose features and prices are set out on the pricing page. Prices are shown excluding tax.

Subscriptions are paid by card through Stripe, monthly and in advance. They can be cancelled at any time, taking effect at the end of the current billing period; amounts already paid for the current period are not refunded.

Right of withdrawal. Pursuant to articles L.221-25 and L.221-28 of the French Consumer Code, a consumer requesting immediate performance of the service before the fourteen-day period expires expressly waives the right of withdrawal for the part of the service already performed.

The following are prohibited:

• using the service for unlawful purposes or in breach of third-party rights;
• storing secrets you are not legitimately entitled to hold;
• storing special categories of personal data within the meaning of article 9 GDPR;
• deliberately overloading the service or circumventing rate limits and quotas;
• reselling, sublicensing or sharing access without prior written authorisation;
• attempting to access data that is not yours or to compromise the integrity of the infrastructure.

Any breach may result in suspension or termination of the account under article 9.

Secrets are encrypted at rest with AES-256-GCM using envelope encryption. On the hosted version the master key is held and administered by the publisher, so the service is not zero-knowledge. The self-hosted version lets you hold that key.

You remain responsible for rotating your own application credentials and for keeping a copy of your critical secrets outside the service. The command-line client's export command lets you retrieve your values at any time.

On the self-hosted version, losing the master key makes secrets permanently unrecoverable; the publisher has no means of restoring them.

The publisher uses reasonable efforts to keep the service available, with no contractual service-level agreement (SLA). Interruptions for maintenance, technical incident or force majeure give rise to no compensation.

The publisher's liability, on any ground whatsoever, is limited to the amounts actually paid by the customer during the twelve months preceding the triggering event. Indirect damages are excluded, in particular loss of business, loss of revenue, loss of data and reputational harm.

These limitations apply neither to personal injury, nor to gross negligence or wilful misconduct, nor to cases where the law prohibits such a limitation.

The publisher may suspend or terminate access in the event of a breach of these terms, non-payment after formal notice, a proven threat to the security of the service, or manifestly unlawful use. In a demonstrable emergency, suspension may be immediate.

You may cancel your subscription at any time from your account, or request account closure. Closure revokes tokens and deletes the associated secrets; it is up to you to export a copy beforehand.

The processing of personal data carried out as part of the service is described in the privacy policy, in accordance with regulation (EU) 2016/679 and French law n° 78-17 of 6 January 1978.

The publisher may amend these terms to reflect changes to the service or to regulations. Substantial changes are notified by email or in the account with reasonable notice. The applicable version is the one in force on the date the service is used; continued use constitutes acceptance.

These terms are governed by French law. The parties will endeavour to settle any dispute amicably before taking legal action.

Consumers may refer the matter free of charge to the mediator CM2C — Centre de la Médiation de la Consommation de Conciliateurs de Justice, 49 rue de Ponthieu, 75008 Paris, France (https://www.cm2c.net/declarer-un-litige.php), or to the European online dispute resolution platform https://ec.europa.eu/consumers/odr.

Failing an amicable settlement, disputes between businesses are submitted to the competent courts of the publisher's registered office, subject to the mandatory rules applicable to consumers.