Security posture

Security & trust

Your data and the integrity of every match run through a hardened, instrumented stack. Encryption, double-blind privacy and continuous monitoring keep the operational layer safe.

Automated alerting
Continuous
Encryption
AES-256 / TLS 1.3
Security controls
Chapter 01
Data encryption

Data encryption

All data transmitted through our platform is encrypted using industry-standard TLS/SSL protocols. Data at rest is encrypted using AES-256 encryption.

Encryption standard
TLS 1.3 / AES-256
Chapter 02
Access control

Access control

Role-based access controls ensure users only access information they're authorised to view. Multi-factor authentication is available for enhanced account security.

Access model
Role-based, least privilege
Chapter 03
Double-blind privacy

Double-blind privacy

Our double-blind matching system protects user identities until mutual approval, keeping privacy intact throughout the initial discovery process.

Identity reveal
Only after mutual approval
Chapter 04
Monitoring & incident response

Monitoring & incident response

Automated alerting on security events runs continuously, 24/7. Human triage and response run during business hours (Mon–Fri, 09:30–18:30 IST), with an out-of-hours escalation path for critical incidents.

Automated alerting
Continuous · human response in business hours
Data protection

Encryption standards

BrandForge employs multiple layers of encryption to protect your data:

  • In transit: TLS 1.3 encryption for all data transmitted between your device and our servers
  • At rest: AES-256 encryption for all stored data in our databases
  • Passwords: Industry-standard bcrypt hashing with salt for password storage
  • Sensitive documents: Additional encryption layer for uploaded files and documents

Access management

We implement strict access controls to ensure data is only accessible to authorised users:

  • Role-based access control (RBAC) system with principle of least privilege
  • Multi-factor authentication (MFA) support for enhanced account security
  • Session management with automatic timeout for inactive users
  • IP whitelisting available for enterprise accounts
  • Detailed audit logs of all access and modifications

Infrastructure security

Cloud security

Our infrastructure is built on industry-leading cloud platforms with enterprise-grade security:

  • Hosted on SOC 2 Type II certified infrastructure (Supabase / AWS)
  • Geographic redundancy across multiple data centres
  • Automated daily backups with point-in-time recovery
  • DDoS protection and web application firewall (WAF)
  • Network segmentation and isolated environments

Application security

We follow secure development practices and conduct regular security assessments:

  • Regular penetration testing by third-party security experts
  • Automated vulnerability scanning and dependency checks
  • Code reviews with security focus before deployment
  • OWASP Top 10 compliance in application design
  • Secure API design with rate limiting and authentication

Compliance & certifications

ISO/IEC 27001 — certificate record

BrandForge Solutions Pvt Ltd holds ISO/IEC 27001 certification for its information security management system. The record below is published so a procurement or vendor-assurance team can verify the certificate directly with the certification body rather than take our word for it.

Certified entity
BrandForge Solutions Pvt Ltd
Standard
ISO/IEC 27001 — Information Security Management System
Certification body
Awaiting confirmation from BrandForgeName of the registrar that issued the certificate
Certificate number
Awaiting confirmation from BrandForgeAs printed on the certificate
Valid from / to
Awaiting confirmation from BrandForgeIssue date and expiry date
Scope of certification
Awaiting confirmation from BrandForgeThe scope statement exactly as worded on the certificate

Need a copy of the certificate or the current Statement of Applicability for a vendor assessment? Email security@brandforge.solutions and we will send it with the audit scope attached.

Everything else, attributed honestly

  • GDPR: Compliant with EU General Data Protection Regulation
  • Data localisation: Compliance with Indian data protection laws
  • SOC 2 Type II: held by our infrastructure providers (Supabase / AWS), not by BrandForge. We do not hold a SOC 2 report and do not claim one.
  • PCI DSS: card payments are processed by Razorpay, a PCI DSS Level 1 certified provider. BrandForge never stores card data.

Privacy by design

Our double-blind matching system is specifically designed to protect user privacy:

  • Anonymised data sharing during initial matching phase
  • Identifying information revealed only after mutual approval
  • Granular privacy controls for profile information
  • Data minimisation principles in system design
  • User consent required for all data sharing

Your responsibilities

Security is a shared responsibility. We ask our users to:

  • Use strong, unique passwords for your BrandForge account
  • Enable multi-factor authentication when available
  • Keep your login credentials confidential
  • Report any suspicious activity or security concerns immediately
  • Keep your browser and operating system up to date
  • Review and understand privacy settings for your account
Report a security issue

If you discover a security vulnerability or have security concerns, please report them immediately:

Email: security@brandforge.solutions

We take all security reports seriously and will respond within 24 hours.

Please do not disclose security issues publicly until we have had an opportunity to address them.

Questions about security?

For more information about our security practices or to discuss enterprise security requirements, contact our security team at security@brandforge.solutions