Security
EDGE holds the records that prove your workforce was qualified to deliver care. Here is how we protect them, stated specifically enough to be checked.
Where your data lives
Your data is held on servers in the United States. We do not transfer personal information outside the United States.
Encryption
In transit. The application is HTTPS only. HTTP requests are redirected, and we send HTTP Strict Transport Security so a browser will not fall back to an unencrypted connection.
At rest. Sensitive fields and the credential documents you upload are encrypted with AES-256-GCM. Encryption keys are held separately from the database, so a copy of the database alone does not yield readable data.
Passwords are stored only as salted hashes. Nobody here can read yours, and we cannot tell you what it is.
Access control
Access is role-based and scoped to a single organization. One agency's users cannot reach another agency's records. Within your organization you decide who sees what, so a scheduler and a compliance officer do not have to share a view.
Administrative access by our own staff is limited to the people who operate and support the service.
How the application is hardened
- Browser protections are enforced by response headers, including HSTS, a content security policy, frame protection against clickjacking, MIME-type sniffing protection, and a referrer policy. The server does not advertise its stack. - Links in our emails are pinned in code, not built from the incoming request. A forged host header cannot cause a password reset, invitation, or signing link to point anywhere but our own domain. - Forms are protected against cross-site request forgery, and session cookies are scoped to the application. - Public form input is filtered. The free-text field on our demo request form is scanned and redacted for anything resembling a Social Security or payment card number before it is stored, because that is not information a sales enquiry should carry.
How the platform protects the record itself
Security is not only about keeping people out. For a compliance record, it is also about the record being trustworthy when it is produced.
- Nobody self-activates. A completed onboarding packet lands as submitted and pending review. Activation requires a person with authority in your organization. - A self-reported credential never clears itself. It stays pending verification until someone records that they verified it against the issuing authority. - An unrecognised role holds rather than clears. If a hire's position matches none of your configured requirements, EDGE stops rather than assuming there is nothing to check. - Signatures carry their own evidence. Every signed document comes back with a certificate recording the document, your organization, the signer, the time, their IP address, and a SHA-256 hash of the file. The hash travels with the document after it leaves EDGE, so a signature can be verified later rather than taken on trust.
Our notification emails carry a name, an organization, and a secure link. They deliberately do not carry personal details in the body, because email is the least controlled surface in any system.
Who else touches your data
A deliberately short list: our hosting provider, our transactional email provider, Stripe for billing, and an AI text-generation provider used only to draft job descriptions from job details you type in, which receives no employee or candidate information. Each is bound to protect the data and to use it only to provide their service to us. The full list is in our Privacy Policy.
We run no analytics and no third-party trackers, on the website or in the application. There is no advertising technology in EDGE.
Privacy and HIPAA
EDGE holds employment records, not patient records. It has no patient charts, no visit or diagnosis data, and no connection to any EHR, and our terms prohibit uploading patient information. Employment records, including health-related items submitted for employment, sit outside the HIPAA Privacy Rule, so we are not a HIPAA business associate and do not offer a business associate agreement.
We treat that information as sensitive regardless, and the state law duties that attach to identifiers such as Social Security numbers apply either way.
Reporting a problem
If you believe you have found a security issue, tell us at security@pulseraedge.com and we will respond. Please give us a reasonable chance to fix it before disclosing it publicly.