Security
Built to pass your security review
AI tools touching company code is a fair worry. Here's exactly what Brandrail does with your code and data, written so your security team can answer their questionnaire from this page.
Code stays local
The CLI and the default MCP server run on the developer's machine. Uploading results is opt-in, and code is never sent with them.
Keys done properly
Created on your machine, stored as a hash, scoped, expiring, revocable at once. No key ever sits in a committed file.
Isolated by design
Row-level security on every table and database functions that check membership on every call.
Least privilege
The GitHub App only sees repos you pick, and every change it makes is a pull request a person approves.
Hardened app
A strict content security policy, security headers, rate limits on sign-in, API, MCP and scanner, and a scanner that refuses private networks.
Checked continuously
An automated security audit runs on every pull request and nightly: secrets in code and history, dependencies, database policies, routes.
The data we hold
| Data | Why |
|---|---|
| Name, email, sign-in provider | Your account |
| Organisation, members, roles, invitations | Access control |
| Brand Kit versions and component registry | The product |
| Check results: repo name, file paths, line numbers, rule, message, score | Dashboard and history |
| API key hashes, prefixes, last-used dates | Authenticating the CLI and CI |
| Audit log | Your records, and investigating incidents |
| Billing contact, plan, seats (card details stay with Stripe) | Invoicing |
We don't store source code, and we don't use your data to train AI models. Delete your organisation and its data is removed from the live database straight away and from backups within 30 days.
Subprocessors
| Service | Used for | Region |
|---|---|---|
| Supabase | Database, sign-in and file storage | Singapore (AWS ap-southeast-1) |
| Vercel | Web app and API hosting | Singapore (sin1); static pages on a global CDN |
| Resend | Sign-in and invitation emails | Japan (Tokyo) |
| Stripe | Payments and invoices (card details never reach Brandrail) | Global; Stripe Payments Australia |
| Sentry | Error reports with request bodies, cookies and user details removed | United States or EU |
| GitHub | GitHub App and sign-in with GitHub, only when you connect them | United States |
| Microsoft, Google | Sign-in, only when you use them | Global |
We'll email organisation owners at least 30 days before adding a subprocessor that handles customer data.
Questionnaire answers
Is source code stored?
No. Code is checked locally by the CLI and MCP server. The hosted MCP tool and the GitHub App check code in memory and keep only the result: file paths, line numbers, rule names, messages and scores.
Is data encrypted?
In transit with TLS 1.2 or higher everywhere (HSTS on, two years). At rest with AES-256 by our database provider. Backups are encrypted again with a passphrase only Brandrail holds.
How is access controlled?
Row-level security on every table, so a request can only read the organisation it belongs to. Roles (owner, admin, member, viewer) decide what each person can change.
Is single sign-on supported?
Sign in with Microsoft Entra ID, Google or GitHub. Two-factor authentication (TOTP) is available to every user. SAML is on the roadmap for Enterprise.
How are API keys handled?
Keys are made on the developer's machine, only their SHA-256 hash is stored, they are scoped, expire after 90 days, show when they were last used, and revoking takes effect immediately.
Is there an audit log?
Yes. Sign-ins, key changes, role changes, invitations and Brand Kit publishes are recorded per organisation.
Are backups taken?
Nightly, encrypted, kept for 30 days, with a written and tested restore procedure.
Do you have SOC 2 or ISO 27001?
Not yet. We will complete your security questionnaire and can sign a data processing agreement.
Where is data hosted?
Today in Singapore (AWS ap-southeast-1). Production is moving to Sydney (AWS ap-southeast-2); Enterprise can require Australian residency.
Who can access customer data at Brandrail?
Only the founder, through the database provider's console with two-factor authentication, and only to provide support you've asked for or to keep the service running.
Incidents
If a breach affects your data we will tell your organisation's owners without undue delay, say what happened and what we're doing, and notify the Office of the Australian Information Commissioner where the Notifiable Data Breaches scheme requires it.
Reporting a vulnerability
Email security@brandrail.com.au with the steps to reproduce. We reply within two business days, keep you updated until it's fixed, and credit you if you'd like. Please don't access other customers' data, degrade the service or run automated scans against production while testing. Good-faith research under these rules won't lead to legal action from us.
Related: Privacy policy · Data processing agreement · Terms of service