Security Overview

Brisko uses a risk-based security program designed for a multi-tenant business application. No system is completely secure, and this overview does not promise absolute security.

Current safeguards

Brisko’s current application architecture includes:

• Clerk-managed identity and session authentication.
• Brisko-owned account memberships, roles, permissions, and location access.
• Tenant- and location-scoped authorization for business records.
• Private object storage for uploaded files.
• Time-limited, authorized direct-upload grants.
• Malware scanning before supported uploads are committed for use.
• Audit records for sensitive operational actions.
• Encrypted network connections in production.
• Dependency, static-analysis, and secret-scanning checks in the release process.
• Application logging and tenant-safe error context for supported request and job failures.

Shared responsibility

Customers are responsible for selecting appropriate user roles, removing access when it is no longer needed, protecting their authentication methods, reviewing activity, and avoiding unsupported sensitive data.

Reporting a concern

Security concerns may be reported to hello@brisko.ai. Please do not include passwords, private keys, or unnecessary sensitive information in the initial report.

Brisko does not claim to be “100% secure,” “unhackable,” SOC 2 compliant, HIPAA compliant, or end-to-end encrypted unless and until the applicable control or independent assurance has been implemented and can be accurately documented.