supapulseData & privacyArchitecture & security
Architecture & security
How Supapulse is built, how ingest requests are checked and processed, how tokens work, and who can see your data.
The stack
- A Laravel application serves the dashboard, the API and the marketing site.
- PostgreSQL stores sites, pageviews, events and revenue.
- Ingest events go onto a queue. Separate worker processes store them, so a traffic spike slows processing down instead of failing requests.
- A WebSocket server pushes live updates to the dashboard.
- Export files and contact-form attachments are stored in DigitalOcean Spaces.
- Billing runs through Stripe Checkout; card details go to Stripe, not Supapulse.
Supapulse runs in one hosting region. There's no choice of data location.
What the ingest API checks
Each POST /api/ingest goes through these checks, in order:
- Rate limit. 2,000 requests per hour per IP address, then
429. - Token present. From the
X-API-Tokenheader or thetokenfield, else401. - Token format. Must start with
pub_orsec_, else401. - Token valid. Must belong to an active site, else
401. - Origin. If the request has an
OriginorRefererheader, its host must be the site's domain or a subdomain of it, else403. - Event type. Public tokens can send
pageviewandevent; secret tokens can also sendrevenue. Anything else is422.
Only then is the event queued and 202 returned.
Tokens
Public (pub_…) | Secret (sec_…) | |
|---|---|---|
| Lives in | Your pages | Your server's environment |
| Can send | Pageviews, events | Pageviews, events, revenue |
| Shown in the dashboard | Always | Once, right after you regenerate it; masked after that |
| Regenerate | Site settings | Site settings |
Regenerating a token invalidates the old one at once. Each token is 32 random characters after its prefix.
Who can see a site's data
Sites belong to teams. Team members have one of four roles: owner, admin, member or viewer. Accounts can turn on two-factor authentication. Supapulse staff with admin access can see accounts and sites to provide support.
Data handling
- IP addresses and user agents travel with each queued job until it runs. They're never written to pageview, event or revenue records.
- Visitor hashes use a per-site salt that rotates every 24 hours by default.
- See Privacy & compliance for retention.
Reporting a security issue
Email support@supapulse.app with the details and how to reproduce them. Please don't test against other customers' sites or data.