Security
Security at Branchly.
How we protect your data and maintain the integrity of your reputation intelligence.
All data is encrypted in transit using TLS 1.2+ and encrypted at rest. Secrets and API keys are stored in isolated environment stores and never logged.
Branchly uses Supabase Auth with JWT token validation on every server request. Sessions expire automatically and tokens are never stored in localStorage.
Row-level security (RLS) is enforced at the database layer — every query is scoped to the authenticated user's data. Our team follows least-privilege access.
We run on Vercel Edge + Cloudflare with automatic DDoS protection, WAF rules and a globally distributed network with no single point of failure.
We monitor dependencies for known CVEs and apply security patches within 48 hours of disclosure. Production is deployed from CI with automated checks.
We have a documented incident response plan. Affected customers are notified within 72 hours of a confirmed breach, as required by LGPD and GDPR.
Third-Party Integration Security
When you connect Google, Facebook or WhatsApp accounts, Branchly requests only the minimum necessary permissions. Access tokens are stored encrypted and refreshed automatically. You can revoke access at any time from your dashboard or directly from the third-party platform.
Responsible Disclosure
Found a vulnerability? Please report it to security@branchly.com.br with a description of the issue and steps to reproduce. We aim to acknowledge reports within 24 hours and resolve critical issues within 7 days. We do not pursue legal action against good-faith security researchers.
security@branchly.com.br