Built for your security team's checklist and your employees' peace of mind
SOC 2 Type II certified. Single-tenant data isolation. Enterprise infrastructure. We publish what we do with your data — and what we will never do.
SOC 2 Type II Certified
Branco has completed an independent SOC 2 Type II audit covering security, availability, and confidentiality. The audit is conducted annually by a third-party auditor. Our full report is available to enterprise customers on request through our Trust Center.
Full documentation in our Trust Center
Sub-processors, DPA, security controls, audit summary, and compliance documentation — all in one place.
How we protect your data
Three pillars: enterprise infrastructure, strict data isolation, and layered access controls.
Hosted on Kinsta with Cloudflare CDN and WAF in front. Data encrypted at rest (AES-256) and in transit (TLS 1.2+). Daily automated backups with point-in-time recovery. Uptime monitored 24/7.
Per-tenant architecture — your data never mingles with another company's. No cross-tenant data flows. No shared embeddings or aggregate models built on customer content. Full data export available at any time via API or CSV/JSON.
SSO/SAML supported. Role-based access control (RBAC) with least-privilege defaults. MFA enforced for admin accounts. All agent on/off toggles are SSO-gated. Every API call logged with tenant ID and request ID.
AI inference & data practices
Branco uses AI inference — not training — on your data. We run third-party inference providers (currently Google Vertex AI) under contracts that prohibit training on Branco-submitted prompts, operate in zero-retention mode, and maintain tenant-isolation guarantees.
We do not fine-tune, RLHF, or build proprietary models on customer content. Your text is used to produce a result for you, then discarded at the inference layer. The score or suggestion is stored; the raw prompt is not retained in inference logs.
If you turn off Branco's AI agents, the platform continues to operate — cycles, calibration, reviews, and action plans all run without AI. See our full AI Commitments →
Policies & documents
Data Processing Agreement (DPA) available on request — email privacy@branco.ai.