Security Documentation

This page describes the technical and organizational measures Bratrax maintains to protect Customer Personal Data. It forms Annex II of the Data Processing Agreement and of the Standard Contractual Clauses incorporated into it. Bratrax may update these measures from time to time provided the overall level of security is not materially reduced.

Pseudonymization and encryption

• In transit. Connections between Customer and the Service are encrypted in transit using TLS. Traffic between Bratrax's own systems travels over an encrypted private network that is not exposed to the public internet. Connections to Bratrax's databases are encrypted in transit.
• Backups. All backup copies of Customer Personal Data are encrypted.
• Credentials. User passwords are salted and stored using a strong one-way hashing algorithm, and are never stored or transmitted in plaintext. Session tokens are cryptographically signed and expire after a defined period.
• Platform credentials. OAuth tokens and platform credentials are used only to retrieve the data Customer has authorized, access to them is restricted to the systems that require it, and they are not written to application logs. Customer may revoke Bratrax's access at any time from the relevant Connected Platform.
• Pseudonymization. Anonymous visitor activity is keyed to pseudonymous session and device identifiers rather than to directly identifying data, until and unless the visitor is resolved to a known customer through Customer's own data.

Confidentiality and access control

• Per-customer data isolation. Each customer's data is held in a dedicated logical data store. One customer's data is not commingled with another's, and application-level access controls scope every query to the requesting customer's own data.
• Role-based access control within the Service: an administrator role with full access to the customer account, and a read-only viewer role that cannot modify configuration, connect platforms, manage users, or access billing.
• Least-privilege access for Bratrax personnel. Access to production systems and Customer Personal Data is limited to personnel who require it to operate or support the Service, is granted through individual accounts over a private network, and is revoked on departure.
• Logged administrative access. Use of Bratrax's internal support role, which permits viewing a customer account as that customer sees it, is logged, recording the person, the customer account accessed, and the time.
• Confidentiality obligations. All personnel with access to Customer Personal Data are bound by written confidentiality obligations.

Integrity and availability

• Data residency. Customer Personal Data is hosted on servers in the European Union (Finland). Encrypted backups are held in cloud storage located in the United States.
• Backups. Customer Personal Data is backed up regularly, using a combination of full and incremental backups with defined retention periods. All backups are encrypted, and backup creation is monitored.
• Pipeline monitoring. Data pipeline and data-quality failures, including extraction jobs and per-customer reconciliation, raise automated alerts to the engineering team.
• Versioning. Data retrieved from Connected Platforms is versioned so that corrections and restatements from the source platform are reflected rather than duplicated.

Resilience and restoration

• The analytics layer is rebuildable from source data held in the raw ingestion layer and, where necessary, by re-retrieval from Connected Platforms, which limits the impact of corruption in derived tables.
• Customer Personal Data can be restored from the encrypted backup set described above.

Governance and testing

• Changes to production systems are made through version-controlled code review, with a second engineer reviewing before merge.
• Infrastructure and application configuration are held in version control.
• Security incidents are investigated, documented, and remediated, and are notified to affected customers in accordance with Section 7 of the DPA.
• Security practices and the Subprocessors listed at bratrax.com/subprocessors are reviewed on a regular basis.

Measures applying to Subprocessors

• Each Subprocessor is engaged under a written contract imposing data protection obligations no less protective, in substance, than those in the DPA.
• Subprocessors receive only the categories of data necessary for their stated purpose, as set out at bratrax.com/subprocessors.
• Subprocessors are reviewed before engagement and periodically thereafter.