Security at BriefBop
Last updated: March 6, 2026
Protecting your data is foundational to everything we build. BriefBop employs industry-leading security practices to ensure your creative assets, campaign data, and account information remain safe.
Encrypted at Rest
All data is encrypted using AES-256 encryption at rest across all storage systems.
Encrypted in Transit
TLS 1.2+ enforced for all data transmitted between your browser and our servers.
SOC 2 Type II
Pursuing SOC 2 Type II certification with continuous monitoring and controls.
Continuous Monitoring
24/7 automated threat detection, alerting, and infrastructure monitoring.
On This Page
1. Infrastructure Security
BriefBop is built on Google Cloud Platform (GCP) through Firebase, leveraging world-class infrastructure with robust physical and network security controls.
Google Cloud Platform
- ISO 27001, 27017, 27018 certified
- SOC 1, SOC 2, SOC 3 compliant
- Physical security with biometric access
- Redundant power and network connectivity
Network Security
- DDoS protection via Google Cloud Armor
- Web Application Firewall (WAF) enabled
- Network segmentation and isolation
- Private VPC for backend services
Firebase Services
We use Firebase Authentication for identity management, Firestore for database storage, Firebase Storage for file uploads, and Cloud Functions for serverless compute. All Firebase services inherit Google Cloud's security certifications and are covered by Google's Data Processing and Security Terms.
2. Data Encryption
2.1 Encryption at Rest
All data stored in BriefBop is encrypted at rest using AES-256 encryption, which is the same standard used by financial institutions and government agencies worldwide.
- Firestore documents and collections are encrypted using Google-managed encryption keys.
- Firebase Storage objects (files, images, documents) are encrypted at rest by default.
- Backups and snapshots are encrypted with the same standards as primary data.
- Encryption keys are managed through Google Cloud Key Management Service (KMS) with automatic key rotation.
2.2 Encryption in Transit
All data transmitted between your devices and BriefBop servers is protected using strong encryption protocols:
- TLS 1.2 and TLS 1.3 enforced for all HTTPS connections. Older protocols (TLS 1.0, 1.1, SSL) are disabled.
- HTTP Strict Transport Security (HSTS) headers prevent downgrade attacks.
- Certificate pinning is implemented in our mobile applications.
- Internal service-to-service communication uses mTLS (mutual TLS) where applicable.
3. Access Controls
3.1 User Authentication
BriefBop supports multiple secure authentication methods through Firebase Authentication:
- Email and password authentication with bcrypt hashing.
- Social sign-in via Google, with OAuth 2.0 and OpenID Connect.
- Multi-factor authentication (MFA) available for all accounts and enforced for admin roles.
- Session management with configurable timeout and automatic expiration.
- Brute-force protection with rate limiting and account lockout policies.
3.2 Internal Access Controls
Access to BriefBop's internal systems and customer data follows the principle of least privilege:
- Role-based access control (RBAC) for all internal tools and systems.
- Access to production data requires documented justification and manager approval.
- All access to sensitive systems is logged and audited regularly.
- Employee access is reviewed quarterly and revoked upon termination.
- Mandatory security awareness training for all employees upon hiring and annually.
4. Compliance & Certifications
BriefBop is committed to meeting the highest standards of security and data protection compliance.
SOC 2 Type II
We are actively pursuing SOC 2 Type II certification covering Security, Availability, and Confidentiality trust service criteria. Expected completion: Q3 2026.
GDPR Compliant
Full compliance with the EU General Data Protection Regulation, including data subject rights, DPA availability, and cross-border transfer safeguards.
CCPA Compliant
Compliance with the California Consumer Privacy Act, including consumer rights, data disclosure requirements, and opt-out mechanisms.
Google Cloud Security
Our infrastructure inherits Google Cloud's extensive certifications: ISO 27001, SOC 1/2/3, PCI DSS, HIPAA, FedRAMP, and more.
5. Vulnerability Management
We take a proactive approach to identifying and remediating security vulnerabilities across our platform.
Dependency Scanning
Automated dependency scanning runs on every build to identify known vulnerabilities in third-party libraries. Critical vulnerabilities are patched within 24 hours; high-severity issues within 72 hours.
Static Analysis & Code Review
All code changes undergo mandatory peer review and automated static analysis scanning (SAST) before deployment. Our CI/CD pipeline includes security linting, secret detection, and license compliance checks.
Penetration Testing
We engage independent third-party security firms to conduct annual penetration tests of our application, infrastructure, and APIs. Findings are triaged, remediated, and verified through re-testing.
Patch Management
Our infrastructure is built on managed services that receive automatic security patches from Google Cloud. Application-level dependencies are continuously monitored and updated through automated tooling.
6. Incident Response
BriefBop maintains a comprehensive incident response plan to detect, contain, investigate, and recover from security incidents quickly and effectively.
Detection & Alerting
Automated monitoring systems detect anomalies and potential security events in real time. Alerts are routed to our on-call engineering team 24/7 via PagerDuty.
Triage & Containment
Incidents are triaged by severity and assigned to the appropriate response team. Immediate containment actions are taken to limit the scope and impact of the incident.
Investigation & Remediation
Root cause analysis is performed to understand the attack vector and scope of impact. Remediation steps are implemented and verified to prevent recurrence.
Notification & Disclosure
Affected customers are notified within 72 hours of confirmed data breaches, in compliance with GDPR and other applicable regulations. Supervisory authorities are notified as required by law.
Post-Incident Review
A blameless post-mortem is conducted after every significant incident. Lessons learned are documented and used to improve our security posture and incident response processes.
7. AI & Data Processing Security
BriefBop is a multi-model AI platform that orchestrates Claude (Anthropic), GPT-4o (OpenAI), and Gemini (Google) in parallel. We take additional security measures specific to AI model interactions and data processing:
- Multi-Model Isolation: Each AI provider receives only the data necessary for its assigned analysis dimensions. No single provider receives all customer data. Customer data is logically isolated across all provider interactions.
- No Third-Party Training: Content submitted to our AI features is not used by any of our AI providers (Anthropic, OpenAI, or Google) to train their general-purpose models. We maintain data processing agreements with all AI providers that enforce this.
- Vector Database Security: Brand knowledge stored in our vector database (Pinecone) is namespace-isolated per brand profile. Embeddings are generated via OpenAI and stored with strict access controls. No cross-organization data leakage is possible.
- Input/Output Filtering: AI inputs and outputs are filtered to prevent injection attacks, data leakage, and generation of harmful content across all three model providers.
- Secure API Communication: All API calls to AI providers (Anthropic, OpenAI, Google AI) are made over encrypted channels with authenticated endpoints and short-lived credentials managed via Google Cloud Secret Manager.
- Graceful Degradation: If any AI provider is unavailable, the remaining models continue processing. The system never exposes error details or provider-specific information to end users.
- Audit Logging: All AI processing requests are logged for security auditing purposes, including which models were used for each job. Logs include metadata (timestamps, user IDs, request types, models used, token costs) but not the full content of prompts or responses.
8. Responsible Disclosure Program
We value the work of security researchers and welcome responsible disclosure of security vulnerabilities. If you discover a potential security issue in BriefBop, we encourage you to report it to us promptly.
Reporting a Vulnerability
- 1Send your report to security@briefbop.com with a detailed description of the vulnerability, including steps to reproduce.
- 2Include your contact information so we can follow up with questions or status updates.
- 3Allow us reasonable time to investigate and remediate the issue before any public disclosure.
Our Commitment
- We will acknowledge receipt of your report within 2 business days.
- We will provide an initial assessment and timeline within 5 business days.
- We will keep you informed of our progress toward remediation.
- We will not pursue legal action against researchers who follow responsible disclosure practices.
- With your permission, we will publicly credit you for the discovery once the vulnerability is resolved.
Scope
The following are in scope for our responsible disclosure program:
- The BriefBop web application and API.
- Authentication and authorization mechanisms.
- Data exposure or leakage vulnerabilities.
- Cross-site scripting (XSS), CSRF, and injection flaws.
- Server-side request forgery (SSRF) and other server-side vulnerabilities.
Please do not perform denial-of-service testing, social engineering of BriefBop employees, or access other users' data during your research.
Have Security Questions?
If you have questions about our security practices or need to report a security concern, our security team is here to help.
Contact Security Team