Agent StudioSecurity and Compliance at Brexy
Brexy is SOC 2 Type I and ISO 27001 compliant, and built for firms that work with confidential financial information.
SOC 2 Type I COMPLIANT
Independent point-in-time review of whether Brexy security controls are designed and implemented for enterprise customers handling confidential financial workflows.
ISO 27001 COMPLIANT
International standard for an information security management system. Confirms how Brexy identifies risk, protects data, and continuously improves security operations.
Control domains we operate.
High-level control families we operate against. Our SOC 2 Type I report covers how these controls are designed and run.
Product security
- Production access reviewed
- Incidents detected and responded to
- Vulnerabilities tracked to remediation
Data security
- Identity verified before access
- Least-privilege production database access
- Access revoked at offboarding
Network security
- Restricted inbound and outbound connections
- External system connections reviewed
- Network changes assessed before rollout
Application security
- Code changes peer reviewed
- Approval required before release
- Privacy notices kept current
Endpoint security
- Anti-malware on every device
- Full device and container encryption
- Endpoint compliance validated
Corporate security
- Code of business conduct
- Defined security roles and responsibilities
- Documented security ownership
Full control lists, monitoring status, and evidence sit behind our SOC 2 audit. See how the platform itself is built for confidential work →
What we do every day.
Certifications are a point in time. These are the practices behind them: written down, reviewed, and followed between audits. Our team will walk you through any of them.
Incident response
Issues are detected, triaged and resolved with a documented response process.
Access control and periodic access reviews
Who can reach what is granted on need, and reviewed on a regular cycle.
Encryption in transit and at rest
Customer data is encrypted as it moves and wherever it is stored.
Vulnerability management
Vulnerabilities are identified, prioritised and tracked through to remediation.
Secure development lifecycle
Every change is peer reviewed and approved before it reaches production.
Privacy by design
Privacy is considered from the first design decision, not added at the end.
Who processes customer data.
The third parties that process customer data on our behalf, what each one is used for, and the category it sits in.
AWS
IT infrastructureHosts the Brexy platform and stores customer documents and deal data.
Google Workspace
Identity providersCompany email, files, and the identity our team signs in with.
GitHub
Version control systemsHolds the Brexy source code and the review history behind every release.
Sprinto
Compliance automationMonitors our controls continuously and collects the evidence behind our SOC 2 report and ISO 27001 certification.
Need the report? Request access.
Tell us who you are and what you need it for. Once we approve the request, we email the documents to you.
