Security

Brinkpost holds your contacts' email addresses and the events your product sends. Here is how we look after them.

Where data lives

The API, the console's data and every workspace are hosted on AWS in us-east-1 (N. Virginia). The API is served through Amazon CloudFront; data is encrypted at rest (AES-256) and in transit (TLS 1.2 or later).

Access

• Console sign-in with email codes or Google, through WorkOS; SAML single sign-on on Scale and Enterprise.
• API keys are stored as hashes and shown once, when created. Any member can revoke a key in the console, effective at once.
• Production access for Brinkpost staff goes through short-lived, audited sessions.

Retention and deletion

Events are deleted at the end of your plan's retention period (30 days on Free, 1 year on Growth, 3 years on Scale). Deleting a contact deletes its events within 7 days. Closing a workspace deletes everything in it within 30 days.

Reporting a vulnerability

Write to security@brinkpost.com. We answer within two business days.