Security & Trust

SOC 2 Type II Certified Providers

Brandkept is built on infrastructure from providers that have achieved SOC 2 Type II certification — the industry standard for security, availability, and confidentiality controls. Our infrastructure stack:

Data Residency

All Brandkept customer data is stored in the United States. Our primary Supabase instance is hosted in US-East-1 (AWS us-east-1). Like all modern web applications, requests may be routed through globally distributed edge nodes for performance; persistent data storage and processing remains in the US.

Brandkept SOC 2 Roadmap

Brandkept itself is a startup and does not yet hold its own SOC 2 certification. We are targeting a SOC 2 Type I assessment aligned with our operational and business milestones as we scale, followed by a Type II audit. We disclose this transparently so you can make an informed decision about using our service. Our reliance on SOC 2 Type II certified sub-processors is the current mitigation for this gap.

Row-Level Security (RLS) on Every Table

Every database table containing user or child data has Row-Level Security policies enforced at the database layer. This means Supabase's Postgres engine enforces that a user can only read, write, or delete rows belonging to their own account — even if an application-level bug accidentally passes the wrong user ID. RLS is the last line of defense and cannot be bypassed by application code.

Multi-Factor Authentication (MFA)

Optional TOTP multi-factor authentication is available in Settings → Security. After enabling it, each login requires both your password and a 6-digit code from your authenticator app (Google Authenticator, Authy, 1Password, or any TOTP-compatible app). We use Supabase Auth to deliver this feature; authenticator app codes are never stored — only the encrypted TOTP secret is retained. We strongly recommend enabling MFA on your account because Brandkept stores children's financial data.

Audit Logging on Minor Data

Every create, update, and delete action on data involving a child — including income records, brand deals, Coogan calculations, and trust accounts — is recorded in an append-only audit log. The audit log captures the user ID, action type, affected record, timestamp, IP address, and user agent. Audit log entries cannot be modified or deleted through the application interface.

Principle of Least Privilege

Internal systems and team members only have access to the minimum data necessary to perform their function. The application's database connection uses a scoped service role for administrative operations and the public anon key for user-facing requests, with RLS enforcing user isolation. Access to raw user data requires explicit justification and is not part of any routine workflow.

Detection Target: 24 Hours

Our internal target for detecting a security incident is 24 hours from the time an anomaly becomes visible in our monitoring systems. Sentry error monitoring and Supabase's built-in monitoring provide baseline anomaly detection.

Breach Notification: 30 Days

In the event of a confirmed breach affecting personal data, we will notify affected users as quickly as practicable — targeting 30 days or sooner. Many state breach notification laws (including California and Texas) require notification without unreasonable delay; we treat 30 days as our maximum ceiling, not our target.

Notification will be sent to the email address on your account. It will describe what data was affected, what we are doing in response, and what actions you should take.

Breach Counsel and Forensics

Retaining breach counsel and a forensic investigation firm is a mandatory pre-launch requirement for Brandkept. Because we handle children's data, incident response readiness is treated as a launch gate — not a post-funding upgrade.