Trust & security
Security you can actually read.
BrytIO holds the data you run your business on. Here is how we protect it, in plain language. Anything not in place yet says so.
Where we stand on certifications. BrytIO does not hold a SOC 2 or ISO 27001 certification today, and we won't imply otherwise. This page lists the controls we have in place today, and the roadmap below says what is not done yet.
Infrastructure & network
Where BrytIO runs and how traffic reaches it.
Encryption in transitLive
Connections are encrypted with TLS, from your browser to Cloudflare and from Cloudflare to our servers. Plain HTTP is redirected to HTTPS.
Edge protectionLive
Traffic passes through Cloudflare for TLS termination, DDoS mitigation, and edge filtering before it reaches the application.
US-based hostingLive
The application and database run on Microsoft Azure in the United States.
Isolated network surfaceLive
The application and database containers are not published to the internet. Web traffic reaches the application only through the reverse proxy.
Application security
How the product keeps one customer's data separate from another's.
Tenant isolationLive
Each record belongs to one workspace, and the application scopes its reads and writes to your workspace. That scoping is covered by automated tests.
AuthenticationLive
Sign-in is handled by Clerk, a dedicated identity provider. BrytIO does not store your account password.
Two-factor authenticationLive
Two-factor authentication (TOTP) is available on every account, and workspace owners and admins can require it for all members.
Role-based accessLive
Owner, admin, and member roles decide who can see financial data, manage the team, and change workspace settings.
Verified webhooks & rate limitsLive
Webhooks from Stripe and Resend are signature-verified, and Shippo's carry a secret token. Public endpoints such as the REST API, booking pages, and lead forms are rate-limited per client.
Data protection
How your data is protected at rest and in our custody.
Database encrypted at restLive
The database is stored on disks that Azure encrypts at rest (server-side encryption with platform-managed keys).
Credentials encrypted againLive
Access tokens for connected integrations, such as Microsoft 365, and 2FA secrets are encrypted a second time by BrytIO, with AES-256-GCM, under a key kept outside the database.
Card details stay with StripeLive
Card payments happen on Stripe's hosted payment pages. Card numbers, expiry dates, and CVVs are not stored in or sent through BrytIO.
Built for business dataLive
BrytIO's built-in fields are for business contacts and operations. It has no built-in fields for health, biometric, racial, or other special-category data.
Encrypted off-site backupsLive
The database is backed up nightly. Each backup is encrypted before it leaves the server and is stored off-site.
Monitoring & change management
How we catch problems and how changes reach production.
Error monitoringLive
Application errors are reported to Sentry. Request bodies, cookies, and auth headers are removed before a report is sent, and session replay is off.
Uptime monitoringLive
Automated health checks and an external uptime monitor watch the service.
Dependency scanningLive
GitHub Dependabot scans our dependencies for known vulnerabilities, and we patch serious advisories.
Automated checks in CILive
Code changes run through automated type checks, unit tests, and a full build in CI.
Breach notificationLive
If we become aware of a security incident affecting your data, we will notify you without undue delay, describe what we know, and tell you what we're doing about it.
Privacy & your data rights
You own your data. Here is what that means in practice.
You control, we processLive
You are the controller of the customer data in your workspace, and BrytIO is the processor. We handle it only on your instructions and to provide the service.
Data Processing AgreementIn legal review
Our Data Processing Agreement is in legal review. Ask through the contact form and we'll send it once it's final.
Export your dataLive
You can download your contacts, companies, deals, quotes, invoices, expenses, and shipments as CSV files at any time (invoices and expenses by owners and admins). On Team and Enterprise plans, the REST API also returns your contacts, companies, deals, quotes, invoices, and shipments.
DeletionLive
Deleting a record removes it from the app. Deleting a workspace removes its records from our production database. Encrypted database backups that still contain them expire after 60 days.
AI and your dataLive
Your data is not used to train AI models, and inputs and outputs are not retained by the model provider for training. Each AI request carries only your own workspace's data, never another customer's. A workspace owner or admin can turn AI off for the whole workspace, and choose whether it may read the text of logged emails and the files you upload. On plans with AI, all three start on: AI itself, reading the text of logged emails, and reading uploaded files. Nothing AI suggests changes your records until a person approves it. The weekly digest email is the one AI task that runs on its own.
On the roadmap
Not done yet. This page will change when each one does.
Independent penetration testPlanned
A third-party penetration test, with a summary report available to customers under NDA.
SOC 2 Type IINot started
Not started. We'll post a start date here when a SOC 2 program begins.
Subprocessors
The third parties that help us run the service. Optional integrations only process data if you connect them. Our Data Processing & Security Policy lists when each one applies and how we give notice of changes.
| Subprocessor | Role |
|---|---|
| Microsoft Azure | Cloud hosting for the application and database |
| Cloudflare | Network edge (TLS and DDoS protection) and file storage (R2), including encrypted database backups |
| Clerk | Sign-in and identity |
| Stripe | Subscription billing, and card payments through Stripe Connect |
| Resend | Email delivery, sending and receiving |
| Sentry | Error monitoring and diagnostics |
| Anthropic (Claude) | AI features, including the AI note in the weekly digest email |
| Microsoft | Microsoft 365 inbox and contact sync (optional) |
| Intuit (QuickBooks Online) | Accounting sync (planned, optional) |
| Shippo | Carrier tracking for UPS, FedEx, USPS, and DHL Express |
| Google (favicon service) | Company logo lookups, when the company's own website has no usable icon |
To show company logos, BrytIO fetches the public website of a company you add (domain only) and, as a fallback, Google's favicon service. When a logo loads in your browser, such as the preview while you type your website during setup, Google also receives your IP address and browser details.
Security questions, or found something?
For security and compliance questions, questionnaires, and DPA requests, contact us and choose “Privacy & data requests.” If you believe you’ve found a vulnerability, report it here with the details and steps to reproduce, and we’ll work with you on it.