Security, privacy and compliance

BrainStorm follows an internal incident management policy which establishes guidelines and standards for mitigating risks from security incidents, including security breaches and data compromises. It emphasizes the importance of planning for incidents before they occur and ensuring effective security for systems, networks, and applications. If an incident occurs, the BrainStorm security team will create a response plan and promptly notify the affected parties. Follow-up will include lessons learned and security hardening to prevent similar events in the future.

Yes, BrainStorm adheres to an SDLC that outlines guidelines and standards for the management and control of BrainStorm's information security acquisition, development, and maintenance. It mandates that information security requirements be analyzed at the earliest planning stages of any system or application to ensure they are an integral part of business requirements.

BrainStorm has implemented a structured vendor review process where vendors are vetted based on the services they provide to BrainStorm. Vendor Assessments are completed through reviewing vendor security policies and audit results to ensure vendor security measures are in line with BrainStorm standards.

The data BrainStorm processes is limited to what is necessary for the platform and does not include sensitive PII.

Yes, BrainStorm ensures that all customer data is encrypted both in transit and at rest. The encryption methods include 256-bit for symmetric encryption, 1024-bit for asymmetric encryption, TLS, and PGP.