Security
Security built into every layer
BrikSync PropOS is defended in depth — at the edge, in the application, and inside the database. Everything on this page is implemented in the product today.
Infrastructure
- Hosted on Vercel and Supabase, which run on SOC 2-certified cloud infrastructure (AWS).
- All traffic served over TLS. HTTP Strict Transport Security is enforced in production.
- Strict Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options headers on every response.
Data protection
- Your records and uploaded files are encrypted at rest by our managed database and storage providers, and every connection is encrypted in transit over TLS.
- Our rate-limiting cache is the one store without encryption at rest, so we keep nothing personal in it — it holds request counters only, and visitor addresses are irreversibly hashed before they are ever used as a key.
- Row-level security is enabled on every database table — the database itself enforces tenant isolation.
- Uploaded files are served through signed, expiring URLs. EXIF metadata — including GPS coordinates — is stripped from JPEG uploads; PNG and WebP files are stored as supplied.
- Sensitive errors are scrubbed of personal data before they reach our monitoring tools.
Access control
- A role-based permission model from account owner down to tenant, enforced at the middleware, server, and database layers.
- Multi-factor authentication is available to every account. Once a user turns it on, it is enforced on every privileged action, not just at sign-in.
- Administrative and customer areas are isolated from each other at the edge.
Application security
- Every input is validated with strict schemas before it reaches the database.
- Cross-site request forgery protection on all state-changing requests.
- Outputs are escaped and spreadsheet formulas are neutralised on data export to prevent injection.
- Rate limiting on authentication and AI endpoints to blunt abuse and brute-force attempts.
Monitoring & audit
- An append-only audit log records security-relevant actions across the platform.
- Application errors and performance are monitored continuously via Sentry.
- A large adversarial test suite exercises authentication, access control, and injection paths on every change.
Reporting a vulnerability
If you believe you have found a security issue, please contact us with details and steps to reproduce. We will acknowledge your report and keep you updated. Please do not publicly disclose an issue until we have had a chance to address it.