Data Security

All data in transit is encrypted using TLS 1.2+ and data at rest is protected with AES-256 encryption. We conduct regular vulnerability assessments and penetration testing on our infrastructure.

GDPR Compliance

As a European company, GDPR compliance is central to how we operate. We maintain records of processing activities, conduct Data Protection Impact Assessments (DPIAs) for high-risk processing, and appoint a dedicated data protection contact.

Secure Infrastructure

Our production systems are hosted on AWS with infrastructure concentrated in the eu-north-1 (Stockholm) region. We leverage VPC isolation, security groups, and automated monitoring to protect client environments.

Access Control

Access to client systems and sensitive data is granted on a strict least-privilege basis. We enforce multi-factor authentication (MFA), regular access reviews, and immediate revocation upon project or employment end.

Vendor Management

All third-party vendors who process personal data are vetted and bound by Data Processing Agreements (DPAs). We maintain an up-to-date sub-processor registry and review vendors at least annually.

Incident Response

We maintain a documented incident response plan with defined roles, escalation paths, and communication procedures. In the event of a data breach, we are committed to notifying affected parties within 72 hours as required by GDPR.

Secure Development

Security is integrated throughout our development lifecycle. Our engineering teams follow OWASP best practices, conduct peer code reviews, use dependency scanning tools, and apply security testing as part of CI/CD pipelines.

Employee Training

Every BrightMarbles team member completes security awareness training on joining and annually thereafter. We foster a security-first culture across all disciplines — from engineering and design to management.