Your data is safe with us
Security is built into everything we do. This page describes the controls that are in place today and the work that is planned.
What we hold, and what we do not yet hold
We publish the status of each certification rather than implying one we have not earned. Anything marked planned is not available to rely on in a contract today.
Encryption in transit
TLS 1.3 is negotiated for every connection, with HSTS (one year, includeSubDomains) and a nonce-based Content Security Policy enforced on responses.
Encryption at rest
Sensitive personal fields — names, email addresses and free-text answers — are encrypted in the application with AES-256-GCM before they are written to PostgreSQL. Database volume encryption at the storage layer is a hosting-provider control and is not enabled by default; application servers keep no customer data on local disk.
SOC 2 Type II
An independent SOC 2 Type II audit is planned. We do not yet hold this certification, and no report exists to share.
ISO 27001
ISO 27001 certification is planned. We do not yet hold this certification.
The controls that are switched on
7 controls protect the platform today. Each one names what it covers and where the limit is.
Encryption in transit
ActiveEvery request is served over TLS 1.3 with HSTS enabled for a year, including subdomains. Responses carry a nonce-based Content Security Policy, frame denial, nosniff and a restrictive referrer policy.
Encryption at rest
ActiveSensitive personal fields — names, email addresses and free-text answers — are encrypted in the application with AES-256-GCM before storage. Volume-level encryption of the PostgreSQL disk is a hosting-provider control, not an application guarantee; application servers hold no customer data on local disk.
Role-Based Access Control
ActiveGranular permissions ensure employees only see their own data, managers see their teams, and admins have org-wide visibility. Role changes take effect on the next request.
Tenant Isolation
ActiveData is separated by organisation, and every query is scoped to the signed-in user's organisation at the data-access layer rather than in the page.
Audit Logging
ActiveAudit trails record key actions and changes within your organisation. Audit-log export is planned.
Multi-Factor Authentication
ActiveOptional multi-factor authentication is available for all accounts. SAML 2.0 and OIDC single sign-on are planned.
Encrypted backups, restore-verified
ActiveDaily database backups are encrypted with a public key before they leave the backup runner, stored in object storage under a lifecycle policy, and verified by an automated restore check. Recovery point objective: 24 hours. Point-in-time recovery is planned.
Where we are against the commitments that get asked about
Procurement teams ask the same 16 questions. These are the current answers, including the ones where the answer is "not yet".
In place today
10 items- Data Processing Agreements (DPA) available
- Responsible disclosure programme with a published policy
- Machine-readable security contact (security.txt, RFC 9116)
- Secret scanning and dependency auditing on every change
- Software bill of materials (SBOM) on request
- Security headers: HSTS, CSP with nonces, frame denial
- Breach notification within 72 hours
- CSV report exports
- Right to erasure (GDPR Article 17) via self-service
- JSON data portability exports
On the roadmap
6 items- Point-in-time recovery
- Independent third-party penetration test
- SOC 2 Type II report
- ISO 27001 certification
- SAML 2.0 and OIDC single sign-on
- Audit-log export
Last reviewed 28 October 2026. This page describes our current technical controls and planned work. It is not a certification or legal opinion. Contact our security team for the latest security documentation.
Who touches your data, and why
We do not resell your data and we do not train any model on it. Each provider below is bound by its own processing terms, and we list them so your procurement team does not have to ask.
A customer-specific sub-processor list, including current hosting regions for your deployment, is available in writing on request. Tell us before you send a questionnaire and we will answer it in the same format.
Hetzner
App hostingRuns the application servers that serve BolderBrain. No customer data is stored on these disks.
Neon
DatabaseManaged PostgreSQL holding assessment, 360 feedback and development data, encrypted at rest with AES-256.
Cloudflare
CDN & WAFDNS, TLS termination, caching and web application firewall in front of bolderbrain.com.
Resend
EmailDelivers transactional email such as invitations, assessment links and password resets.
Razorpay
PaymentsProcesses credit purchases. Card details are entered on Razorpay's systems, never ours.
Sentry
Error monitoringReceives application error and performance data so failures can be diagnosed and fixed.
OpenAI and Anthropic
AI narrativesGenerate assessment narrative text when an organisation enables AI. The feature can be switched off per organisation, and API content is not used to train their models.
Encrypted object storage
BackupsHolds nightly database backups that are encrypted before upload. Location and vendor are listed in the sub-processor schedule on request.
Found a vulnerability? Tell us.
We run a disclosure programme with a published policy: acknowledgement within 3 working days, an assessment within 10, and a 90-day window before public disclosure. No bounty, and we say so rather than pretending otherwise.
Need a security questionnaire filled in?
Send us your vendor assessment and we will answer it in writing, including the items we cannot yet say yes to.
- Written answers, not a sales call
- DPA available for review
- Named contact for follow-up questions