BrandShip
Security
BrandShip runs AI agents that act for your business, so the most important security property is simple: an agent can only do what you connected it for, and anything that spends money or speaks for your brand in public waits for you.
Report a vulnerability
Email security@getbrandship.com with the subject "Security report". Include the URL or feature, the steps to reproduce and what an attacker could do. We reply within 3 business days and keep you updated until it is fixed. Machine-readable contact: /.well-known/security.txt.
In scope: getbrandship.com and app.getbrandship.com. When testing, please:
- Use only accounts you own. Don't access, change or delete other people's data; if you reach any, stop and tell us.
- Don't run denial-of-service, spam, social-engineering or physical tests, and don't use automated scanners at a volume that degrades the service.
- Give us reasonable time to fix the issue before sharing it publicly.
If you act in good faith within these rules, we will not pursue legal action against you for your research. We don't run a paid bug bounty yet.
Your connected accounts
- Least privilege. We ask each service for the narrowest permission that does the job. Gmail is connected with send-only access; we can't read your mailbox.
- Tokens stay on the server. Access tokens for Google, LinkedIn, Slack and other services are stored server-side and never sent to your browser. Agents reach them through one internal accessor, not directly.
- Connecting is not permission to act. Ad budget changes are applied only after you approve that specific change. Social posts wait for your approval unless you turn on automatic publishing yourself. Agents can only move or cancel calendar events they created, never your own.
- You can disconnect any service at any time from Connections, or revoke access from the provider's own settings.
Application
- All traffic is encrypted with TLS, and both domains are HTTPS-only (HSTS, submitted to the browsers' preload list).
- Passwords are stored as bcrypt hashes. Setup and reset links are single-use, expire, and are stored only as SHA-256 hashes.
- Sign-in and the API are rate-limited per IP and per account.
- A strict Content-Security-Policy, clickjacking protection and no-referrer policy are set on the app.
- Webhooks from outside services are verified by signature before anything is processed, and duplicate deliveries are ignored.
- Every workspace's data is scoped to that workspace on the server, not in the browser.
Data
- The database is managed PostgreSQL (Neon) in the EU (Frankfurt), encrypted at rest, with point-in-time restore.
- Every message an agent sends on your behalf is logged in the app (Apex → Sent), so you can see exactly what left your accounts.
- The services that process your data are listed in our Privacy Policy. AI providers receive only what the task at hand needs.
- A Data Processing Agreement is available for business customers.
Certifications
BrandShip is listed on the Cloud Security Alliance STAR Registry at Level 1 (self-assessment). Our answers to all 283 questions of CSA's Consensus Assessments Initiative Questionnaire (CAIQ v4.1) are public there, including the controls we don't have yet. Level 1 is a published self-assessment, not an independent audit.
We don't hold SOC 2 or ISO 27001 certification yet, and we won't claim otherwise. If your team needs a security questionnaire answered, email us.
Thanks
We will credit researchers who report valid issues here, with their permission.