Security & Compliance
Built for trust,
from the first byte
ISO/IEC 27001:2022 certified, SOC 2 Type 2 attested, encrypted end-to-end, and engineered so your data never leaves your infrastructure.
Certifications
Independently audited
Bruin's information security management system is certified to ISO/IEC 27001:2022 and examined annually against the AICPA Trust Services Criteria.
ISO/IEC 27001:2022
Our information security management system is certified to ISO/IEC 27001:2022 by Prescient Security. The scope covers the design, development, operation, and maintenance of the Bruin platform: Bruin CLI, Bruin Cloud, ingestion, transformation, orchestration, data quality, governance, and AI-agent/MCP integrations, along with the infrastructure hosted on Google Cloud Platform and DigitalOcean.
- Certificate number
- 123371 (Issue 1)
- Certification body
- Prescient Security LLC
- Issued
- August 19, 2026
- Valid until
- August 18, 2029
SOC 2 Type 2
Prescient Assurance examines Bruin annually against the AICPA Trust Services Criteria for security, availability, and confidentiality, testing how the controls operated over the full audit period rather than at a single point in time. The report is a restricted-use document, so we share it under NDA.
- Auditor
- Prescient Assurance LLC
- Framework
- AICPA Trust Services Criteria
- Criteria covered
- Security, availability, confidentiality
- Report access
- Under NDA, on request
SECURITY & COMPLIANCE
Enterprise-Grade Security
ISO/IEC 27001:2022 certified and SOC 2 Type 2 attested, with comprehensive security controls and audit capabilities.
Role-Based Access
Granular permissions, scoped per channel and team
Audit Logs
Complete activity tracking
Single Sign-On
SAML 2.0 & OAuth
Encryption
AES-256 at rest & transit
Private Links
VPC peering support
Data Residency
GDPR compliant
Access Controls
IP whitelisting
Two-Factor Auth
Additional security layer
99.9%
Uptime SLA
24/7
Monitoring
ISO 27001
Certified ISMS
Data protection
Your data stays yours
Bruin runs transformations inside your warehouse. Customer data does not leave your infrastructure, and no raw data is ever used to train any model.
Warehouse-native execution
Transformations run inside your Snowflake, BigQuery, Databricks, Redshift, or Postgres. Customer data never leaves your infrastructure.
No model training on your data
Your raw data is never used to train any model. AI calls send only the metadata and SQL needed to answer a question.
Granular retention
Personal data is kept only as long as needed for the service or to meet legal obligations. Delete or export anytime from account settings.
EU data residency
Pick the region your tenant runs in. We support EU residency for customers with GDPR or local data-residency requirements.
Sub-processor transparency
Every third-party processor is contractually bound by data processing agreements that honor our privacy commitments to you.
Data subject rights
Access, correction, deletion, and portability requests are handled in-product or directly via [email protected].
AI privacy
The AI analyst sees metadata, not your raw data
The AI reads schema, metadata, and quality state, generates SQL, and runs it against your warehouse. Only the results needed to answer the question pass through. All model calls go through enterprise LLM endpoints with no-training agreements.
No model training
Your data is never used to train any model, ours or third-party.
Enterprise endpoints
All LLM calls run through enterprise endpoints with no-training agreements.
Warehouse-native
SQL runs in your warehouse. Raw data never leaves your infrastructure.
Infrastructure
Hardened by default
Encryption, isolation, and continuous monitoring across every layer of the platform.
AES-256 encryption at rest
All customer data and backups are encrypted at rest with AES-256 using managed keys.
TLS 1.2+ in transit
All traffic between clients, services, and warehouses is encrypted in transit with modern TLS.
Private network links
VPC peering and private connectivity options are available for enterprise tenants.
Role-based access control
Granular permissions, scoped per workspace, project, and asset. Least privilege by default.
Single sign-on
SAML 2.0 and OAuth on enterprise plans. SCIM provisioning available.
Two-factor authentication
Required for all internal staff. Available for all customer accounts.
Audit logs
Complete activity tracking for queries, asset changes, access, and administrative actions.
24/7 monitoring
Continuous infrastructure and security monitoring with on-call response.
Background checks
All Bruin staff with access to production undergo background checks and sign confidentiality agreements.
Compliance
Standards we meet
SOC 2 Type 2
Audited annually against the AICPA Trust Services Criteria for security, availability, and confidentiality.
GDPR
Lawful processing, data subject rights, and EU data residency. We act as a processor on behalf of our customers.
Sub-processors
Each service provider that processes data on our behalf is bound by data processing agreements honoring our privacy commitments.
Data subject rights
Access, correction, and deletion requests are handled through the in-product settings or by contacting our team directly.
Vulnerability disclosure
Report a security issue
We work with security researchers acting in good faith. If you believe you have found a vulnerability, we want to hear about it.
What to include
- - Clear description of the vulnerability
- - Steps to reproduce
- - Affected URL, endpoint, or component
- - Screenshots or proof-of-concept
- - Potential impact
What to expect
- - Acknowledgment within 3 business days
- - Regular status updates
- - Notification when resolved
- - Credit for your discovery, if you wish
- - Safe-harbour for good-faith research
Resources
Documents & policies
Privacy Policy
How we collect, use, and protect personal data.
Terms of Service
Terms and conditions of use for the Bruin website and services.
Vulnerability Disclosure
How to report security issues and what to expect when you do.
Legal Disclosure
Bruin Data Limited company information and impressum.
[email protected]
Direct line to our security team for issues, questionnaires, and audit requests.
[email protected]
Privacy questions, data subject requests, and general inquiries.
Talk to our security team
Need the SOC 2 report under NDA, a DPA, a security questionnaire response, or a deep-dive call? We'll get it to you.