Security is engineered, not bolted on.
Bridge's security posture is shaped by the customers Brevor serves: health systems handling PHI, financial services with regulator review, defense contractors with FedRAMP requirements. Every Bridge deployment ships with the same security baseline. Customers configure higher tiers as their environment requires.
The baseline includes encryption in transit (TLS 1.3) and at rest (AES-256), role-based access controls, full audit logging of administrative actions, automated key rotation, and isolation between deployments. Single-tenant deployments add per-customer key management. Air-gapped deployments (Bridge Stone) remove network egress entirely.
Our security team operates a 24/7 incident response rotation across five offices. The same team contributes the audit-trail specification to the AI Safety Index.
Certifications maintained continuously.
All certifications are maintained on continuous assessment, not point-in-time audits. SOC 2 Type II reports refresh annually. HIPAA BAA executes per deployment. FedRAMP Moderate authorization applies to single-tenant deployments serving federal customers.
ISO 27001 and CSA STAR certifications cover the Brevor operating environment. PCI DSS Level 1 applies to deployments handling payment-card data. GDPR posture is documented in the Data Processing Addendum (DPA).
Data is encrypted by default at every layer.
Sub-processors and their roles.
The sub-processors listed below provide infrastructure to Brevor Tech, Inc. The list is reviewed quarterly. Customers are notified 30 days in advance of additions or material changes.
How we notify customers.
Brevor notifies affected customers of confirmed security incidents within 24 hours of confirmation. Notification includes scope, impact, mitigation status, and remediation timeline.
For incidents subject to regulatory reporting (HIPAA, GDPR, state breach-notification statutes), Brevor coordinates with the customer to meet regulator timelines. Customers maintain primary regulatory notification responsibility for their deployment's data subjects.
Security inquiries route to security@brevortech.com. Active customers escalate via their account team and the 24/7 incident response line documented in the deployment agreement.
Trust packet
Brevor maintains a current trust packet — SOC 2 Type II report, HIPAA BAA template, sub-processor list, DPA, and security questionnaire responses. The packet is shared with active buyers under NDA.
Request trust packet →