Security at Brico
Brico holds the documents behind your licenses: ownership structures, financial statements, background check materials, and correspondence with state regulators. We protect them accordingly, so your vendor file is ready when an examiner asks.
Security
Independent audit. Brico holds a SOC 2 Type 2 attestation covering the Security category, audited by Insight Assurance. The full report is available under NDA.
Encryption. Customer data is encrypted in transit and at rest. Company laptops run full-disk encryption.
Access control. Only named members of our Operations team can access production. Access is reviewed quarterly and removed within one business day of departure.
People. Every employee passes a background check. All employees complete security training at onboarding and every year after.
Secure development. Every code change is reviewed by someone other than its author. Software testing runs in CI/CD. We pentest annually.
Vulnerability management. Our source code and dependencies are scanned continuously, and production is scanned at least quarterly. An independent firm tests the production environment at least once a year.
Infrastructure. Brico runs on AWS . Data is backed up daily and encrypted.
Incident response. We keep a documented incident response plan with a named security officer and on-call coverage, and we test it every year. If an incident affects your data, we notify you.
Vendors. Every subprocessor is assessed before onboarding and reviewed at least annually. See the current list on our Trust Center.
Privacy
Privacy policy. Read how we collect and use data in our Privacy Policy.
Retention. Formal retention and disposal procedures govern company and customer data, and we review them at least annually.
AI. Brico's AI features run on Amazon Bedrock, which is covered by our SOC 2 controls. AWS and the third-party model providers will not use any inputs to or outputs from Amazon Bedrock to train Amazon Nova, Amazon Titan, or any third-party models.
Request documentation
Our SOC 2 report, security policies, and subprocessor list are available at trust.brico.ai.
Found a vulnerability? Email security@brico.ai.
Last reviewed: October 15, 2026