1. In short
Pursor drafts replies to your customers' texts and emails, and a person (you) approves every one before it is sent. This page explains how we protect the data that involves, how to report a security problem, and what we do if something goes wrong. Report a problem any time to security@pursor.co. Our machine-readable contact file is at /.well-known/security.txt.
2. How we protect your data
- Encryption in transit. The site and the app are served only over HTTPS, with HTTP Strict Transport Security turned on.
- Encryption at rest. Our database provider (Supabase) encrypts stored data at rest. On top of that, the Google access tokens Pursor holds are encrypted by our own servers with AES-256-GCM under a dedicated key that never reaches your browser. Business tax ids (EINs) are encrypted the same way under a separate key.
- Access limited to the owner. Each business owner can read only their own business's data: the database enforces this with row-level security, and our server code looks up every draft, message and setting by the signed-in owner's account. Customers' texts and emails are shown only to the business they wrote to.
- Least access to Google. Pursor asks Google only for what its features use: reading recent Gmail, sending the replies you approve, and the events on your own calendar. It never labels, archives or deletes your email.
- Your control. Disconnecting Google revokes Pursor's access and deletes the email content Pursor stored, right away. You can ask us to delete your whole account; see How to delete your data.
- Hardening. A strict Content-Security-Policy, rate limits on sign-up, sending and other sensitive actions, and error monitoring.
3. Google user data
Pursor's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google user data for advertising or to train AI models. What Pursor reads and sends, and why, is set out in our Privacy Policy and on the screen you see before you connect Google.
4. How to report a security problem
Email security@pursor.co with what you found, the steps to reproduce it, and how to reach you. Please don't access, change or delete other people's data, don't run tests that slow the service down for others, and give us a reasonable time to fix the problem before you share it publicly. We won't take legal action against good-faith research that follows these rules.
We aim to acknowledge every report within 3 business days and to keep you updated until it's resolved.
5. How we respond to an incident
- Contain. Stop the problem: revoke or rotate the affected keys and access tokens, and pause the affected feature if needed.
- Assess. Work out what happened, which accounts and which data were affected, and when.
- Notify. Tell affected business owners without undue delay, and regulators where the law requires it. If Google user data may be involved, we notify Google promptly at security@google.com and before making any public statement, as the Google Workspace user data and developer policy requires (section "Maintain a secure operating environment").
- Fix and learn. Fix the cause, check the fix, and write down what we changed so it doesn't happen again.