Your business data, protected.
BLUBRICK holds the plans, customers, and decisions behind your business. We treat that responsibility seriously. Here's how we keep it secure, private, and available — in plain language.
Encryption
- All traffic is encrypted in transit with TLS (HTTPS), enforced by HSTS.
- Your data is encrypted at rest in our managed Postgres database and object storage.
- Secrets and API keys are stored in environment configuration, never in source code or the browser.
Authentication & access
- Accounts are protected by our authentication provider with secure password hashing.
- Optional two-factor authentication (TOTP) is available in your account settings.
- Sign out of all devices anytime; sessions use short-lived tokens that refresh automatically.
Data isolation
- Every workspace's data is isolated with row-level security in the database.
- Members only see the workspaces they belong to — enforced at the data layer, not just the UI.
- AI requests send only the minimum context needed to answer you.
Infrastructure
- Hosted on reputable managed cloud infrastructure with a global CDN.
- Managed Postgres with automated, provider-level backups.
- Environment separation keeps development and production isolated.
Privacy & your rights
- You own your business data. We never sell it or use it for advertising.
- Export or delete your data and account on request — see the Privacy Policy.
- We support GDPR and CCPA data requests.
Compliance posture
- Payments are handled by a PCI-DSS Level 1 certified payment processor; we never store full card numbers.
- Built toward SOC 2-aligned practices: least privilege, audit logging, and change control.
- Clear, BLUBRICK-specific legal terms — not generic boilerplate.
Backups & data retention
Your data is stored in managed Postgres with provider-level automated backups. We retain your data while your account is active; when you delete your account, we remove your business data, subject to limited legal and operational retention. You can export your data at any time.
Incident response & disclosure
If you discover a vulnerability, please report it responsibly to security@getblubrick.com — don't publicly disclose it or access other users' data. We investigate reports promptly and, in the event of an incident affecting your data, will notify affected users as required by law.
Subprocessors
Trusted partners that help us run BLUBRICK, by role. We share only what each needs to do its job. The specific named list is provided in our Data Processing Agreement and available on request.