Security & Privacy

Your brand data is yours. Always.

We built Brand Foundation with privacy-first architecture. Here's exactly how we protect what matters most to your business.

Core Commitments

Our promises to you

✅

Your data is never used to train our models

Brand Foundation does not use your brand inputs, answers, or generated Foundation documents to improve or retrain our AI. Your proprietary brand strategy stays private.

✅

You own everything you create

All Foundation documents you generate are fully owned by you. We hold no license to your outputs. Export, delete, or transfer them at any time.

✅

No data sold to third parties

We do not sell, rent, or share your brand data with any third party — for any purpose, including advertising or research.

✅

Data deletion on request

You can permanently delete your account and all associated data at any time. We process deletion requests within 30 days.

Infrastructure

Infrastructure security

Feature	Status
Data encryption at rest	✅ AES-256
Data encryption in transit	✅ TLS 1.3
Cloud infrastructure	✅ Enterprise-grade (AWS / GCP)
Access control	✅ Role-based (RBAC)
Penetration testing	🔄 Annual
SOC 2 Type II	🔄 In progress
GDPR compliance	✅
Data residency options	🔄 Coming Q3 2025

Compliance

Compliance roadmap

✅ Completed

2025 Q2: Internal security audit complete

🔄 In Progress

2025 Q3: SOC 2 Type II certification initiated

2025 Q4: GDPR Data Processing Agreement (DPA) available for enterprise clients

🗓️ Planned

2026 Q1: ISO 27001 assessment

FAQ

Security questions answered

No. Your Foundation is private by default and only accessible by you and team members you explicitly invite.

Access to customer data is strictly limited to authorized engineering personnel for debugging purposes only, under a formal access policy.

Data is currently stored on enterprise-grade cloud infrastructure. Data residency options for EU and APAC customers are on our roadmap.

You can export all your Foundation documents before cancellation. After account deletion, all data is permanently removed from our systems within 30 days.