Security Statement

Last Updated: August 1, 2024

At Brightcreek Software, security is not an afterthought—it's a core principle of our engineering culture. We are committed to protecting our clients' data and intellectual property with a multi-layered, defense-in-depth security strategy.

Secure Software Development Lifecycle (SDLC)

Security is integrated into every phase of our development process, from design and coding to testing and deployment. We conduct regular code reviews, static and dynamic analysis, and follow OWASP Top 10 guidelines.

Cloud Infrastructure Security

We leverage leading cloud providers like AWS, Google Cloud, and Azure, adhering to best practices for network security, access control (IAM), and infrastructure-as-code (IaC) to ensure a secure and resilient foundation.

Data Encryption

All data is encrypted in transit using TLS 1.2+ and at rest using industry-standard AES-256 encryption. We manage encryption keys securely to prevent unauthorized access.

Data Protection & Resilience

We implement regular, automated backups and have a disaster recovery plan in place to ensure business continuity and data integrity. All sensitive data is masked and anonymized in non-production environments.

Access Control

We enforce the principle of least privilege. Access to production systems is strictly limited to authorized personnel and requires multi-factor authentication (MFA). All access is logged and audited.

Compliance & Audits

Our practices are designed to be compliant with major standards like SOC 2, ISO 27001, GDPR, and HIPAA. We conduct regular third-party penetration tests and security audits to validate our controls.

Reporting a Vulnerability

If you believe you have discovered a security vulnerability in our services or on our website, please contact our security team immediately at security@brightcreeksoftware.com. We appreciate your help in keeping our systems secure and will investigate all legitimate reports.