Legal, v1.0, Ottawa
Security is table stakes.
We build with security-by-default as a non-negotiable. Full detail on our architecture, our compliance posture, and our bug bounty is available to partners on request.
Encryption
AES-256 at rest · TLS 1.3 in flight
All user data encrypted at rest with keys under scheduled rotation. All network traffic over TLS 1.3.
Auth
Email + password, scrypt-hardened
Email and password sign-in with scrypt key derivation, built in-house on our sovereign backend. Credentials encrypted in transit and at rest. Sessions revocable at any time.
Compliance
Law 25 · PIPEDA · GDPR
Law 25 and PIPEDA aligned, with GDPR-aligned practices. SOC 2 is on our roadmap. Data residency: Canada only, racked at OVHcloud Beauharnois, Quebec.
Bug bounty
Responsible disclosure
Responsible disclosure program for security researchers. Write to security@brandsai.ca.