Built to handle sensitive work.

Brivo processes public records and produces intelligence that ends up in boardrooms, courts, and compliance files. Security is not an afterthought — it is a precondition.

Our posture

We assume breach. We build for recovery. We disclose without delay.

Every system that touches customer data is designed with the assumption that perimeters fail. Defence is layered, access is minimal, and logging is comprehensive.

Questions not answered here can be directed to security@brivo.ltd.

AES-256Encryption at rest

TLS 1.2+Encryption in transit

72 hMax breach notification

Compliance & attestations

Where we are, not where we wish we were

GDPRCompliant

DPA available on request.

DPDP (India)In progress

Working towards compliance with the Digital Personal Data Protection Act.

SOC 2Roadmap

Targeted for 2027.

ISO 27001Roadmap

Targeted for 2027.

Security practices

Encryption at rest

All stored data is encrypted with AES-256. Database volumes, backups, and file stores are encrypted at the block level. Keys are managed through a dedicated secrets management system with automatic rotation.

Encryption in transit

All connections are enforced over TLS 1.2 or higher. We reject older protocol versions and weak cipher suites. Certificates are auto-renewed and monitored for expiry.

Access control

Production access is restricted to named individuals with a documented business need. All access requires MFA. Permissions follow least-privilege principles and are reviewed quarterly. Offboarding revokes access within one hour.

Infrastructure

Systems run on cloud infrastructure with network segmentation, private subnets, and no unnecessary public endpoints. Security groups are reviewed on every deployment. Audit logging is enabled across all environments.

Penetration testing

We commission independent penetration tests against production systems. Findings are triaged, tracked, and remediated under defined SLAs. Critical findings block releases.

Backups & recovery

Automated backups run daily with point-in-time recovery enabled. Restores are tested on a regular cadence. Recovery objectives are documented and reviewed with each infrastructure change.

Dependency management

All third-party dependencies are tracked and scanned for known vulnerabilities on every build. High-severity findings block deployments. We maintain a software bill of materials (SBOM) for production services.

Incident response

We maintain a written incident response plan with defined severity levels, escalation paths, and communication templates. Post-incident reviews are mandatory for any severity-1 event. Affected customers are notified within 72 hours of a confirmed breach.

Employee security

All staff complete security awareness training before system access is granted and annually thereafter. Phishing simulations run throughout the year. Security practices are part of the engineering hiring process.

Data retention & deletion

Data is retained only as long as required to deliver the service or meet legal obligations. Customers may request deletion of their data at any time. Deletion requests are actioned within 30 days and confirmed in writing.

Self-hosted by default

Fewer vendors, fewer surfaces

The fewer parties we share your data with, the fewer parties can lose it.

Where most teams reach for a SaaS, we run our own. Analytics, captchas, and customer support all live on our infrastructure. Visitor data, ticket history, and behavioural signals never reach a third-party vendor.

AnalyticsUmami

Privacy-friendly, cookieless. No data leaves our infrastructure.

CAPTCHASelf-hosted

No third-party challenges. Visitor IPs and behaviour stay with us.

Customer supportSelf-hosted

Conversations and ticket history are not shared with a SaaS vendor.

Responsible disclosure

Found something? Tell us before anyone else.

If you discover a vulnerability in Brivo's systems, please report it to security@brivo.ltd. We will acknowledge your report within 24 hours and provide a resolution timeline within 72 hours.

We ask that you give us reasonable time to investigate and remediate before any public disclosure. We do not pursue legal action against researchers who act in good faith under these guidelines.

Please include: affected URL or system, steps to reproduce, potential impact, and your contact details. Encrypted submissions are welcome using the PGP key below.

In scope

+brivo.ltd and all subdomains
+brivo.support and all subdomains
+brivo.network and all subdomains
+Brivo product domains

Out of scope

−Third-party services we depend on (report to them directly)
−Social engineering of Brivo staff or customers
−Physical attacks against Brivo offices or staff
−Denial-of-service or volumetric testing
−Findings from automated scanners without demonstrated impact

Response SLAs by severity

SeverityAcknowledgeResolve / mitigate

Critical4 h24 h

High24 h7 d

Medium72 h30 d

Low5 dNext release

PGP public key

For encrypted disclosure

Key ID0x0A4D47F046581FD0

AlgorithmRSA 4096

Created2026-05-23

ExpiresN/A

FingerprintF924 C1FC F6C1 541E 788E 7AC7 0A4D 47F0 4658 1FD0

Brivo Security <security@brivo.ltd>

ASCII-armored · brivo-security.ascDownload key

Verify the fingerprint above against the copy published at /.well-known/security.txt before encrypting anything sensitive. If they don't match, contact us out of band before sending the report.