Trust Center

Sub-processors

The main sub-processors are listed below; the complete list, including optional integrations, is on the Sub-processors page. Material changes are announced at least 30 days in advance, and tenants are notified by email at their DPO contact address.

Resilience and verification

We answer the questions every practice asks in due diligence: how often we back data up, how long a restore takes, and what security auditing exists. We publish only figures we can evidence from our infrastructure.

Per-organization isolation

The organization is the tenant boundary in Brivio. Below is how that is enforced technically, where it is checked automatically, and what that check does not cover.

A real case, from the inside: on 4 September 2026 we found and fixed an issue in the client portal: documents were filtered by organization and by the "visible in portal" flag, but not by the contact who had uploaded them, so one client could see another client's uploads within the same organization. No organization saw another organization's data. We publish the case because it shows exactly the limit above: a gate proves what it checks, and no more.

Certifications and auditing

These are the questions asked by a practice that is professionally accountable for its clients' data. We answer them directly, including when the answer is "no".

Are you ISO 27001 certified?

No. Brivio is not ISO 27001 certified and is not currently undergoing certification, so we cannot announce a date. What we do instead are the controls described on this page: EU-only hosting, envelope encryption with a rotatable KEK, an append-only hash-chained audit log, per-organization isolation checked in CI, backups with published RPO/RTO, and weekly automated security scanning. Those are verifiable controls, not a certificate — and we name them as such.

Do you have a confirmation from DNSC?

No. DNSC does not issue a security certification for software vendors, and we hold no attestation from it. We report security incidents in line with the applicable legal obligations and handle vulnerability reports through the coordinated disclosure channel above.

Is there an independent penetration test?

The first independent pentest is planned for Q1 2027; a summary of the report will be published on this page. Other attestations (for example US-style audit reports) are prepared only when a customer requires one by contract.

Is there a bug bounty programme?

No. We do not run a bug bounty programme and do not pay rewards. We accept reports through coordinated disclosure, at the security address in the section above, and we respond to them.

We claim no certification we do not hold. If a statement on this page cannot be verified, treat it as an error and tell us.

GDPR Rights & DSR

Data subjects (end users) and customers (controllers) can exercise any of the GDPR rights under Art. 15-22.

• Art. 15 — access to personal data.
• Art. 16 — rectification.
• Art. 17 — erasure ("right to be forgotten").
• Art. 18 — restriction of processing.
• Art. 20 — portability (ZIP export with all of the organization's data).
• Art. 21 — objection to processing.

Beyond GDPR requests, any organization can download its own complete archive, per company, from Settings → Company archive. The archive contains that company's business data — not the other companies in the account — and includes a per-section digest, so its contents can be verified as unmodified since export. It is available at any time, without asking us, without approval from us, and at no charge.

Send your request to privacy@brivio.ro or, if you are a customer, open a ticket at Settings → Compliance.