Brakett is operated by THE BORING TECH CO. This page describes the security measures actually in place — the same controls documented in our internal compliance records.
Encryption
- All traffic is encrypted in transit (TLS/HTTPS).
- Data is encrypted at rest (AES-256) on our hosting provider, Supabase.
- Secrets and API credentials live in a managed vault — never in source code, configuration files or logs.
Tenant isolation
Every business’s data is isolated with database row-level security: an authenticated user can only ever read or write data belonging to their own business. This is enforced in the database itself, not just the application.
Payments
Payments are processed by Paystack. Brakett never sees or stores card numbers — only a transaction reference and amount. Payment webhooks are cryptographically verified (HMAC signatures) before being trusted.
Access
- Links that expose data or actions (payment links, reschedule/cancel links, file downloads) are single-purpose, signed, and expire.
- Privileged actions — data export, erasure, workspace deletion, money movements — are written to an audit log with the actor recorded.
- Production access is limited and documented in an internal access register.
Data protection
We operate under the Nigeria Data Protection Act (NDPA) 2023: affirmative opt-in consent for marketing, data minimisation, a retention schedule with automatic purging, and data-subject export and erasure — see the Privacy Policy.
Reporting a vulnerability
If you believe you’ve found a security issue, email privacy@usebrakett.com with the details. We investigate every report and will respond promptly. Please don’t access data that isn’t yours while demonstrating an issue.
Incidents
We maintain a breach-response plan: detection, containment, assessment, and notification of affected businesses and the NDPC within the timelines the NDPA requires.