Security

PubNub provides two developer-facing tools for securing your application: Access Manager for controlling who can read and write on your channels, and encryption for protecting data in transit and at rest. Both are independent and can be used together or separately.

	Access Manager	Encryption
What it protects	Who can access channels, channel groups, and user metadata	Message and file content; network transport
How it works	Token-based permissions issued by your server	TLS for connections; AES-256 for message and file content
When it runs	On every PubNub API request	TLS: always on. Message/file encryption: when configured in the SDK
Engineering effort	Medium (server-side token grant API required)	Low (SDK configuration)
Availability	Optional add-on. Enable on your keyset in the Admin Portal.	TLS: included on all plans. Message/file encryption: SDK-level, no plan requirement.

Access Manager

Access Manager is an optional add-on that controls which clients can read from or write to PubNub resources. Without it, any client that holds your subscribe and publish keys has unrestricted access to all channels on that keyset.

Access Manager uses time-limited tokens. Your server holds the secretKey and calls PubNub to generate tokens for authenticated users. Each token encodes a set of permissions and a time-to-live (TTL). The client receives the token from your server, sets it as the authKey, and PubNub validates it on every subsequent request.

Three resources can be gated:

Resource	Permission flags
Channel	read, write, delete, get, update, manage, join
Channel group	read, manage
UUID metadata	get, update, delete

Permissions can be granted by exact resource name or by a RE2 regex pattern, allowing one token to cover many channels without listing each one.

Every Access Manager token requires a ttl in minutes, and there is no default. An Access Manager token's ttl ranges from 1 minute to 43,200 minutes (30 days). When a token expires or is revoked, the client receives a 403 and must request a new token from your server.

Encryption

PubNub secures data at two levels: transport and content.

Transport security

All connections to PubNub use TLS 1.2 by default. TLS is enabled in the SDK during initialization and applies to every API call. Some SDKs expose this setting as ssl (a legacy name), but the underlying protocol is TLS.

Disabling TLS is possible during SDK initialization but is not recommended for production applications.

Message and file encryption

Message and file content can be encrypted end-to-end using AES-256, with a key you bring and manage yourself. All clients that send and receive encrypted content must configure the SDK with the same cipher key.

The CryptoModule is the recommended approach. It supports AES-CBC 256-bit encryption. A CryptoModule configured for AES-CBC 256-bit encryption can also decrypt content encrypted with the legacy 128-bit module. Historical messages and files remain readable after you switch to it.

Two scopes are available:

• All messages and files: register a CryptoModule at SDK initialization to encrypt everything the client sends and receives on that keyset.
• Individual messages or files: create a standalone CryptoModule instance and call encrypt() or decrypt() per item to encrypt selectively.

PubNub servers handle only ciphertext and never store cipher keys. A client without the correct cipher key receives unreadable content.

Data residency

Storage can be locked to EU-only, US-only, or APAC-only regions. For the region and retention rules of each storage system, refer to Data persistence and privacy.

Organization access

Admin Portal roles are separate from Access Manager. Access Manager controls what your app's clients can do on channels and user metadata. Admin Portal roles control what members of your PubNub organization can do in the Admin Portal, such as editing keysets, viewing secret keys, or reading usage.

Invite organization members to give a teammate access, and assign each one a role from Admin Portal roles. The Admin Portal also supports single sign-on (SSO). For the sign-in options, refer to Set up your account.

Audit log

The Audit Log in Admin Portal records every action performed across your PubNub organization: who changed an app, keyset, role, Service Integration, or account setting, and when. It covers actions from the Admin Portal, the Admin API, and OAuth integrations.

The PubNub Audit Log shows the full event history on the Starter and Pro plans. On the Free plan, the PubNub Audit Log shows a preview of the 5 most recent events.

Compliance

PubNub is ISO 27001 certified, SOC 2 Type II and SOC 3 audited, and HIPAA, GDPR, and CCPA compliant. PubNub also participates in the EU–U.S. Data Privacy Framework (DPF). For the certificate and audit reports, visit the PubNub Trust Center. Pro plan customers can access the most recent reports directly from the Admin Portal, under Organization settings. Other customers can request them from PubNub Compliance.

For how PubNub stores, retains, and lets you delete your application's data, refer to Data persistence and privacy.