Security

We take the security of your brand and your data seriously. braaand runs on infrastructure that is independently audited and certified to the standards large organisations expect, and we keep our own surface area small, modern, and well understood. This page explains the providers we build on, how data is protected, and how we work.

braaand runs on a modern serverless stack. Compute, data, and authentication are handled by dedicated providers, and each maintains its own independently audited security and compliance program.

• Vercel hosts the application, serverless functions, and global content delivery. Vercel maintains a SOC 2 Type 2 attestation and is ISO 27001:2022 certified, supports GDPR, and provides automatic DDoS mitigation across a global edge network.
• Neon runs our Postgres database. Neon holds SOC 2 Type 1 and Type 2, SOC 3, ISO 27001, and ISO 27701, and adheres to GDPR and CCPA. Data is encrypted on disk and backed up on a regular schedule.
• Clerk handles sign-in, sessions, and account security. Authentication is managed by a specialised, SOC 2 Type 2 audited system rather than something we rolled ourselves.

Your data is encrypted in transit and at rest. Connections use HTTPS with TLS 1.3. Stored data is encrypted on disk with 256-bit AES by our database and hosting providers.

Sign-in, sessions, and account security are handled by Clerk, a dedicated authentication provider. Passwords and login flows live in a specialised, audited system instead of something built in-house.

We support social sign-in, and for teams we support domain-based access so the right people are added automatically and everyone else stays out. Inside the product, access to a brand is checked on every request, and team administrators control who can see and edit what.

Hosting runs across a global edge network with automatic failover and built-in DDoS mitigation, so a problem in one region does not take the service down. The database is replicated for resilience, with automated backups taken regularly and retained so data can be recovered if something goes wrong.

We process personal data in line with GDPR. Our providers offer EU data regions and rely on standard data transfer mechanisms when data moves between regions.

What we collect, how we use it, and the sub-processors we rely on are described in our Privacy Policy.

Good infrastructure only helps if you use it carefully. A few practices we hold ourselves to:

• Access to production is limited to the people who need it, and secrets are kept out of the codebase.
• Infrastructure is managed as code, so changes are reviewed and easy to trace.
• Workloads run in isolated serverless functions that do not share state between customers.
• We rely on well-maintained, widely used dependencies and keep them up to date.
• We are a small team, so few people have access and every change is easy to reason about.

If you believe you have found a security issue, we want to hear about it. Email us at security@braaand.ai with enough detail to reproduce the issue, and please give us reasonable time to investigate and fix it before any public disclosure. We appreciate it.

Last updated 16 June 2026