Skip to main content
Draft, not yet in force. This document is being reviewed and will change before it applies to anyone. Last updated: 4 October 2026.

​
How we approach it

Brand Atlas holds the material a company is most careful with: its logo, its fonts, its unreleased work. We keep the system small, use established providers for the parts that are hardest to get right, and say only what is true here.

​
Hosting and where data lives

  • The app is hosted on Vercel.
  • The database and sign-in system are on Supabase, in Frankfurt, Germany.
  • Brand Files and our backups are stored in Cloudflare R2, in Cloudflare’s EU jurisdiction.
The full list of providers is on the Subprocessors page.

​
Encryption

  • All traffic to Brand Atlas is encrypted in transit with HTTPS.
  • Our providers encrypt stored data at rest.
  • Our nightly database backup is encrypted before it leaves the database.
  • If you add your own AI key for Henry, it is encrypted again on its own, in a separate vault. We only ever show its last four characters.

​
Who can see your data

  • Each brand’s data is kept apart by row-level rules in the database, so one account cannot read another’s.
  • Inside an account, the owner decides who has a team seat. Team members see only the brands they are seated in.
  • A small number of our own staff have administrative access, used only to run and support Brand Atlas.

​
Signing in

  • You sign in with your email and a password, or with a one-time code sent to your email.
  • Passwords are stored only as secure hashes by our sign-in provider.
  • Codes expire after 10 minutes, allow 5 tries, and are limited in how many can be requested.
  • Our sign-up and sign-in forms check that you are a person, using Cloudflare Turnstile.
  • Log out of all devices, in your account settings, ends every session, including connected AI apps.
Two-factor sign-in is not available yet.

​
Sharing

  • Share links use long random tokens that cannot be guessed.
  • You choose how long a link lasts, and you can switch it off at any time.
  • People who open a share link can view what you shared, and cannot change anything.
  • File downloads use links that expire after a short time.

​
Connected AI apps

AI apps connect through the Atlas MCP with a standard sign-in (OAuth), with Read or Read and write permission that you choose. Every connection is listed in your account settings under MCP, where you can revoke it at once. See the AI terms.

​
Backups

The database is backed up every night, encrypted, and kept for 30 days. [TEAM TO CONFIRM: whether Brand Files are backed up, and what we promise about restoring.]

​
Our providers’ certifications

Brand Atlas does not hold a security certification of its own. Our main providers do: Supabase, Vercel, Cloudflare and Stripe each publish independent audit reports, such as SOC 2 Type 2, on their own sites. [TEAM TO CONFIRM: the certification each provider holds today.]

​
Reporting a vulnerability

If you think you have found a security problem in Brand Atlas, write to [TEAM TO CONFIRM: security contact email] with what you found and how to reproduce it.
  • We will acknowledge your report within [TEAM TO CONFIRM: response time].
  • Please give us a reasonable time to fix it before telling anyone else.
  • Do not access, change or delete data that is not yours, and do not disrupt the service. Test only against an account of your own.
If you act in good faith and follow these rules, we will not take legal action against you for your research. [TEAM TO CONFIRM: publishing a security.txt file at app.brandatlas.pro/.well-known/security.txt that points to the same contact.]

​
Changes

  • 4 October 2026: first draft.