Security is table stakes.
We build with security-by-default as a non-negotiable. Full detail on our architecture, our compliance posture, and our bug bounty is available to partners on request.
Encrypted in flight, encrypted storage and backups
Every connection to BrandsAI runs over TLS 1.3. Storage volumes and backups are encrypted, with keys under scheduled rotation. Some fields, an email address we have to be able to write to, are deliberately held in a form the service can read back, and our privacy policy names which and why rather than implying a protection we do not apply.
Email and password, hardened key derivation
Email and password sign-in built in house on our own Canadian backend. Passwords are never stored, only a salted derivation of them produced by a memory hard function. Credentials are encrypted in transit, and sessions are revocable at any time.
Law 25 · PIPEDA · GDPR
Law 25 and PIPEDA aligned, with GDPR-aligned practices. SOC 2 is on our roadmap. Data residency: Canada only, racked at OVHcloud Beauharnois, Quebec.
Responsible disclosure
Responsible disclosure program for security researchers. Write to security@brandsai.ca.