Security & Compliance
Enterprise-Grade Security & Compliance
Your drawings, certs, and customer data sit in a private instance, encrypted at rest and in transit, with role-based access and a complete audit trail on every record.
Security-First Architecture
Every aspect of BrixIQ is designed with security and compliance in mind, from infrastructure to application layer.
Enterprise-Grade Encryption
End-to-end encryption for data in transit and at rest using industry-standard AES-256 encryption.
- AES-256 encryption at rest
- TLS 1.3 encryption in transit
- Key management with HSM
- Regular security assessments
Zero-Trust Architecture
Modern security framework that verifies every access request regardless of location or user credentials.
- Multi-factor authentication required
- Device trust verification
- Continuous access monitoring
- Principle of least privilege
SOC 2 Type II
Independent audit of our security, availability, and processing integrity controls.
- Annual third-party SOC 2 Type II audits
- Comprehensive security control framework
- Continuous monitoring and improvement
- Transparent security reporting
ITAR-Ready Architecture
Designed to handle export-controlled information with proper access controls and data residency requirements.
- US-only data residency options
- Role-based access controls
- Export control compliance monitoring
- Comprehensive audit trails
Standards We Build To
The frameworks our architecture and evidence structures are designed around, so the records you keep in BrixIQ hold up when your own auditor asks for them.
- SOC 2 Type II (Security, Availability, Processing Integrity)
- ISO 27001 Information Security Management
- ITAR (International Traffic in Arms Regulations)
- AS9100 alignment
Data Protection & Privacy
Your data is protected with multiple layers of security controls and privacy protections.
Data Residency Control
Choose where your data is stored and processed with regional data centers and compliance options.
- US, EU, and Asia-Pacific regions
- Planned: US-only data residency option
- Customer-controlled data location
- Local compliance support
Backup & Recovery
Comprehensive data protection with automated backups and disaster recovery capabilities.
- Automated daily backups
- Point-in-time recovery
- 99.9% uptime guarantee
- Geographic redundancy
Access Controls
Granular access controls with role-based permissions and comprehensive audit logging.
- Role-based access control (RBAC)
- Single sign-on (SSO) integration
- Multi-factor authentication
- Session management
Audit & Monitoring
Complete visibility into system access and data usage with comprehensive audit trails.
- Real-time activity monitoring
- Comprehensive audit logs
- Automated compliance reporting
- Security incident detection
Infrastructure Security
Built on enterprise-grade cloud infrastructure with multiple layers of security controls and monitoring.
Cloud Infrastructure
Hosted on AWS data centers (which carry SOC 2 attestations from AWS), with DDoS protection and network-level security controls.
Database Security
Encrypted databases with automated patching, access controls, and continuous security monitoring.
Network Security
Advanced firewalls, intrusion detection, and network segmentation for maximum security isolation.
Security Certifications
Where each audit stands today. We update this section as each one completes.
SOC 2 Type II
Annual independent audit of security, availability, and processing integrity controls
In progressISO 27001
International standard for information security management systems
In progressAS9100 alignment
Aerospace quality evidence structures aligned to AS9100 workflows
In progressITAR
Architecture and controls for export-controlled information
In progressSecurity Operations
Our commitment to security goes beyond compliance to operational excellence.
- Dedicated security operations center (SOC)
- 24/7 security monitoring and incident response
- Regular security training and awareness programs
- Continuous threat intelligence and vulnerability management
- Documented incident response procedures
- Automated threat detection and alerting
- Customer notification within 24 hours
- Post-incident analysis and improvement