Security

A summary for the security and procurement teams who review brandflare. The privacy policy sets out what we collect and why, and the subprocessor list names every provider and what it receives.

Certification

brandflare itself has not been audited for SOC 2 or ISO 27001. The service runs on providers that have been, and nothing of a customer's is kept anywhere else:

• Vercel (hosting, storage, AI gateway): SOC 2 Type 2 and ISO 27001.
• Neon (database): SOC 2 Type 2, ISO 27001 and ISO 27701.
• Clerk (sign-in): SOC 2 Type 2.
• Stripe (payments): PCI DSS Level 1. Card details go to Stripe and never reach us.
• Resend (email): SOC 2 Type 2.

We are glad to complete a security questionnaire for a client who needs one.

Where data is kept

The application runs in Vercel's US East region and the database in Neon on AWS us-east-1, in the United States. Data is encrypted in transit, with HTTPS enforced on every address, and at rest by those providers. Uploaded documents and generated reports are held in private storage and can only be reached through the brand they belong to. The database can be restored to an earlier point in time.

Your data and AI

• We do not train AI models, and we do not let your data be used to train anyone else's.
• Facts, documents and answers go only to Anthropic and OpenAI, through their developer services, whose terms forbid training on them. Those calls are made under zero data retention, so the provider keeps neither the request nor its result once the call is done, beyond what it must hold to check for misuse.
• Tracked questions are written like an ordinary consumer's and carry no account details. An owner or admin can limit a workspace to the providers' developer services, so nothing is asked in the consumer apps or sent to DeepSeek.

Who can get in

• Sign-in is handled by Clerk, by email or Google. Two-factor authentication is available to everyone, and a workspace can require it of its whole team. Each person can see and sign out their active sessions.
• Each member of a workspace has a role (owner, admin, editor or viewer), and every change is checked against that role on the server.
• Our own staff use a separate administration app, with its own sign-in and its own database account that can change only the few things support needs. Looking at a customer's workspace there is read-only, and every action is written to a log that the app can add to but never edit or delete.

Keys and connections

• API keys are stored only as a one-way hash, and are rate limited.
• A Google Analytics connection is stored encrypted with AES-256-GCM, under a key the database never holds. It can only read, and the customer can take it away at any time.
• Forms on the public site are checked for automated abuse.

Deleting data

The owner of a workspace can delete it from Settings. It closes at once and is erased seven days later, including its uploaded files; until then the owner can undo it. You can also ask us to erase your data, and we will do it within 30 days. The privacy policy lists the little we keep afterwards, and why.

If something goes wrong

If a breach affects your data, we will tell you without undue delay, and the relevant authority as the law requires. To report a security issue, write to hello@brandflare.io.