Security
Information security is not an afterthought. It is the foundation of everything we do.
Certification
ISO/IEC 27001 certified
BrainStax B.V. is ISO/IEC 27001 certified. This is the international standard for information security. The certificate confirms that we maintain an Information Security Management System (ISMS) that meets the highest requirements for the protection of data and information.
Our certification covers all services: from AI Inspiration Sessions and Define & Discover engagements to production implementations on the BrainGrounds platform. This means your data is in safe hands with us, from the first conversation to daily use.
How we work
Security in practice
Data encryption
All data is encrypted in transit (TLS 1.2+) and at rest. No exceptions.
Access control
Strict role-based access. Only those who need access get access. Always with MFA.
Continuous monitoring
Security incidents are monitored 24/7. Anomalies are detected and resolved immediately.
Supplier management
Our vendors meet the same security standards. BrainGrounds runs on Databricks with enterprise-grade security.
Business continuity
Tested disaster recovery plan. Regular backups. Minimal downtime during incidents.
Awareness training
Every team member regularly completes security awareness training. Security is a shared responsibility.
Responsible Disclosure
Found a vulnerability?
We appreciate security researchers helping us keep our systems safe. Have you discovered a vulnerability in our website or services? Report it through our responsible disclosure policy.
What we ask
- Describe the vulnerability in as much detail as possible, including steps to reproduce it.
- Give us reasonable time to fix the issue before disclosing it publicly. We aim to resolve within 90 days.
- Do not exploit the vulnerability beyond what is necessary to demonstrate it.
- Delete any data obtained immediately after reporting.
- Do not carry out attacks that affect the availability of our services (DDoS, spam, etc.).
What we promise
- We will acknowledge your report within 3 business days.
- We will keep you informed of our progress.
- We will not take legal action if you follow the above rules.
- We will credit your name (if you wish) in recognition of your contribution.
Out of scope
- Social engineering attacks on employees
- Physical attacks on office or infrastructure
- Denial of Service (DoS/DDoS) attacks
- Automated scans without prior permission
Downloads
Questions about security?
Get in touch. We are happy to discuss how we protect your data.