System Policy
Version 1.1 · Effective 30 October 2026
This policy sets out how CorePulse™ executes the evaluation: how activation keys work, what exports are required, how data moves through the system, how reports are verified, and what use is permitted. It forms part of the Terms of Use and Conditions. Capitalised terms have the meanings given in those Terms.
1. What the evaluation measures
1.1CorePulse is BridgeCore's evaluation version of the STRATA platform: providing one measurement of your ERP estate at no charge for evaluation purposes only and accessible for a defined evaluation period. The evaluation is a single measurement of one SAP Estate, taken from Exports that reflect that estate on the Export Date, provided to the Organisation for the purposes of evaluating STRATA against its own estate.
1.2Every figure is computed deterministically: the same Exports always produce the same Results. No machine learning, large language model or human judgement is used in any computation.
1.3Where an input required for a measure is absent from the Exports, CorePulse returns a null result for that measure. It never estimates a missing value.
1.4The Results are a diagnostic baseline issued to validate the STRATA measurement against the Organisation's landscape. They are not a remediation plan, a legal or licensing opinion, an audit, or an architectural mandate.
2. Activation keys
2.1An Activation Key is issued in the Organisation's registered name, to a User BridgeCore has verified as acting for that Organisation. A BridgeCore administrator sends the key in a password-protected PDF, and sends the password in a separate email.
2.2Each key permits one measurement of one SAP Estate. It is consumed on the first completed measurement and cannot be reused.
2.3A key is exclusive to the Organisation. It may not be sold, transferred, shared with another organisation, or used for an estate the Organisation does not own or operate.
2.4An unused key expires 30 days after issue. Where a scan does not complete, including where the browser is closed, activation is refused or the key expires, BridgeCore will issue a replacement key on request. A reissue is not a further measurement and carries no charge.
2.5Access to CorePulse opens on activation of the key. The Evaluation Period is 7 days from scan completion. Results and reports are deleted 30 days after scan completion.
2.6A consultant, systems integrator or other adviser may run the scan only as agent for the named Organisation, with its written authority. The key, the report and all rights under it belong to the Organisation, not the agent.
3. One scan per estate
3.1Each SAP Estate will receive one evaluation measurement. At intake, CorePulse derives a one-way fingerprint of the estate from the Exports. The estate is identified by that fingerprint, not by the name of the requester. No system values can be read from the fingerprint.
3.2CorePulse compares that fingerprint against the fingerprints of other scanned estates, solely to enforce the 'one scan per estate' policy. To support the one scan per ERP estate limit, BridgeCore retains only a one way cryptographic fingerprint derived from the technical exports. No readable values or file contents are stored. A further completed measurement of the same estate, obtained other than by request to BridgeCore under 3.3, whether through another person, email address, organisation name or agent, is a breach of the Terms of Use and Conditions. A reissue under 2.4 is not a second measurement.
3.3After amendments to the estate, the Organisation may request a subsequent evaluation from BridgeCore, on commercial terms BridgeCore confirms at the time. Continuous measurement is provided under the STRATA platform, subject to the BridgeCore Strata Master Agreement.
4. Export requirements
The Organisation must ensure that the Exports:
4.1are taken from the SAP Estate named at intake, by a person authorised by the Organisation to extract them;
4.2derived from an SAP ECC 6.0 system, the only release CorePulse currently supports, and are complete and unaltered, in the format and scope set out in the CorePulse Export Guide;
4.3carry the correct Export Date, which is the date the Results will reflect;
4.4contain no data beyond the scope of the Export Guide, and in particular no transactional business data, financial records, customer records, or special personal information as defined in POPIA s26; and
4.5may lawfully be provided to BridgeCore, including any SAP user identifiers they contain.
5. How data moves through CorePulse
| Stage | What happens |
|---|---|
| 1. Upload | Exports are transmitted over HTTPS (with HSTS) to CorePulse on Hetzner Cloud in Nuremberg, Germany |
| 2. Intake | A cryptographic hash of each file and a one-way fingerprint of the estate are written to append-only registers, with the Activation Key, Organisation name, Export Date and scan date |
| 3. Measurement | Exports are processed in memory only, never written to disk. Each file is read once and measured |
| 4. Deletion | The Exports are deleted at scan completion. No copy of uploaded files is kept, not in backups and not in logs |
| 5. Report | The Results are issued as reports marked confidential. A hash of each issued report is added to the register |
| 6. Retention | Results, reports and hash records are stored on the server and backed up nightly in encrypted form to Hetzner Object Storage in Nuremberg. Results and reports are deleted automatically 30 days after scan completion; hash records are retained. Backups roll over after 35 days |
Results are not shared, benchmarked or aggregated with any other party, whether identifiable or de-identified. The only cross-client comparison is of the one-way estate fingerprint under 3.2.
6. Verifying a report
6.1Any report can be verified against its Intake Record at verify.bridgecore.io. BridgeCore will confirm, on request by the Organisation or a person it authorises, whether a presented report matches the report issued. Verification confirms only that a report was issued by CorePulse and has not been altered. It does not endorse or certify the findings.
6.2A report that has been altered in any way will not verify. Extracts, summaries or reproductions of a report are not verified reports.
6.3The Organisation may ask BridgeCore to delete its reports and measured results. Verification does not read the report: it reads the register record holding the report's unique hash, which is never deleted. A report the Organisation holds can therefore be verified at verify.bridgecore.io indefinitely, whether or not BridgeCore still holds a copy.
6.4Reports are deleted 30 days after scan completion. The Organisation should download and keep its reports within that period. BridgeCore cannot reissue a report after it has been deleted, but a report the Organisation holds remains verifiable under 6.3.
7. Acceptable use
Users must not:
7.1upload Exports of an estate the Organisation does not own or operate, or without its authority;
7.2upload malware, or files crafted to disrupt, probe or exploit CorePulse;
7.3attempt to access another Organisation's data, key or report;
7.4test, scan or probe the security of CorePulse, except under section 8;
7.5access CorePulse by automated means other than its published interfaces;
7.6reverse engineer, decompile or attempt to derive the methods, algorithms, indices or scoring of CorePulse from its outputs or behaviour;
7.7submit altered, synthetic or third-party Exports to study how CorePulse scores them; or
7.8use CorePulse, its Results or anything learned from it to build, benchmark, train or support a competing product or service.
8. Security reporting
Report suspected vulnerabilities or security incidents to hello@bridgecore.io. BridgeCore will not pursue action against good-faith reports that avoid accessing other Organisations' data, avoid disrupting the service, and allow BridgeCore reasonable time to remedy the issue before disclosure.
9. Availability and support
CorePulse is an evaluation service, not a production service. It is provided on a best-efforts basis, without any availability or response-time commitment. Support requests go to hello@bridgecore.io. Support covers the operation of CorePulse. It does not cover interpretation of Results for remediation, which requires an SAP-certified consultant or a separate engagement with BridgeCore.
10. Suspension and revocation
BridgeCore may suspend or revoke an Activation Key, or refuse an intake, where it reasonably believes this policy or the Terms of Use and Conditions have been breached. Where practicable, BridgeCore will tell the Organisation why.