Security
Last updated: 11 October 2026
Brava holds deal plans that matter to both sides of a sale. Here is what we do to protect them, and what we don't offer yet.
How your data is stored
Your data lives in a Supabase Postgres database. Row-level security is switched on for every table, so one company's data is never visible to another. Brava is hosted on Vercel and served over HTTPS. Connection tokens for linked CRMs are stored encrypted.
Accounts and sign-in
- Passwords are handled by Supabase Auth. We never store them in plain text.
- Password reset works through a one-time link sent by email.
- Sign-in, registration and password reset are rate limited to slow down guessing.
- Buyers reach their shared plan with a six-digit access code sent to their email. The code expires after 15 minutes, and repeated wrong guesses are blocked.
Payments
Payments are handled by Paddle, our merchant of record. Your card details never touch Brava's servers.
Transactional email, such as access codes and password resets, is sent through Resend.
Backups
Weekly encrypted backups of production data, with an automatic restore test.
What we don't offer yet
We don't offer single sign-on (SSO), an uptime SLA, or a SOC 2 report today. For Enterprise customers, we help with security reviews and questionnaires on request.
Reporting a security issue
If you think you've found a security problem, email dimas@getbrava.tech. We'll read it and reply.