Access control
In the product. Unique user ids, bcrypt passwords, HttpOnly sessions, hashed API tokens, organisation RBAC.
Still an operator job. Joiner/mover/leaver reviews, who may grant platform admin, MFA policy.
Trust
Security review, as the product exists
Pulsar Cards does not hold a Type II audit report, a GDPR certificate, or a DPDP certificate. It is not an RBI-authorised payment system, prepaid instrument issuer, or payment aggregator. It is not a TRAI-registered Principal Entity or telemarketer unless operations records a Principal Entity ID. This site describes technical controls in the product today. Signed MSA, DPA, and audit reports are issued by counsel and a licensed CPA firm — not generated by this page.
Change management
In the product. Git history; additive SQL migrations; deploy notes in docs/DEPLOYMENT.md.
Still an operator job. Ticket → review → deploy records and a named approver per release.
Logging
In the product. Auth and abuse events, request ids, /api/health. Raw analytics events expire after 30 days.
Still an operator job. Log review cadence, optional SIEM, on-call rota.
Backup and recovery
In the product. sql/tools/backup.php exists. No RPO/RTO is claimed.
Still an operator job. Off-site copies, encryption of backup media, timed restore drill.
Privacy
In the product. Export, delete, consent flags, 18+ signup gate, withdraw/nominate/grievance tickets, opt-in search indexing, purpose-minimized analytics. No visitor dossier.
Still an operator job. Notices, DPA, transfer mechanism, appointed grievance officer, Consent Manager under DPDP.
Payment instruments (RBI-adjacent)
In the product. Invoice billing only. Writes refuse Luhn-valid card numbers and card-named fields. Hosted Stripe/Razorpay Checkout is off unless BILLING_HOSTED_CHECKOUT is set with signed webhooks. The product never collects PAN.
Still an operator job. Do not enable BILLING_HOSTED_CHECKOUT or store card data without an RBI authorisation and PCI SAQ A review. Hosting region is operator-declared. This is not a PCI or RBI certificate.
Commercial communications (TRAI / TCCCPR)
In the product. No server SMS, voice, or WhatsApp Business API. Follow-ups and share open wa.me / sms: / tel: / mailto: on the owner device. Bulk recipient lists are refused. Send stubs fail closed.
Still an operator job. Do not register as a Principal Entity or send UCC unless a named wave adds a DLT path. Empty PE-ID means not a telemarketer. This is not a TRAI registration.
Evidence pack
A machine-readable inventory of controls in this product. It sets every certification claim to false.
Request a review
Open a ticket, or email contact@pulsar.cards with the questionnaire your security team uses. Answers come from the live product and the readiness notes — not invented reports.