Security
At BrandDeck we take the security of your data seriously. This page explains how we protect the data you store on our platform. We believe in being transparent about our security practices so you can make an informed decision about trusting us with your brand assets and client data.
Infrastructure and hosting
All BrandDeck data is stored on servers located in Germany. We have chosen German-based infrastructure specifically to ensure that your data stays within the European Union and remains fully compliant with GDPR. Our hosting provider maintains physical security, redundant power and network connectivity to ensure high availability.
Data encryption
All data transmitted between your browser and BrandDeck is encrypted using TLS (Transport Layer Security). Data stored on our servers is encrypted at rest. This means that even in the unlikely event of unauthorized physical access to our servers, your data remains unreadable.
Access control
Access to BrandDeck systems is limited to authorized team members only. We use role-based access controls so that each team member can only access the systems they need for their work. Access is reviewed regularly and revoked immediately when no longer needed.
Backups
We perform regular automated backups of all data. Backups are encrypted and stored separately from primary data. This ensures that we can restore your data in the event of an incident.
Account security
We recommend that all BrandDeck users:
• Use a strong and unique password for their BrandDeck account
• Enable two-factor authentication where available
• Do not share login credentials with others
• Log out of shared or public devices after use
If you suspect unauthorized access to your account, contact us immediately at hello@branddeck.co.
Incident response
In the event of a security incident, we have procedures in place to respond quickly and minimize impact. We will notify affected users in accordance with our obligations under GDPR, including within 72 hours of becoming aware of a breach that affects personal data.
Third-party providers
We work with carefully selected third-party service providers for hosting, payments and email. All providers are bound by data processing agreements and are required to maintain appropriate security standards. We only use providers that store data within the European Economic Area.
ISO certification
BrandDeck is currently working towards ISO 27001 certification. While we are not yet certified, we have implemented information security practices aligned with that standard. If you have specific compliance requirements, please contact us at hello@branddeck.co and we will be happy to discuss how we can meet your needs.
Responsible disclosure
If you discover a security vulnerability in BrandDeck, we ask you to report it to us responsibly. Please contact us at hello@branddeck.co with a description of the issue. We will acknowledge your report within 48 hours and work to resolve the issue as quickly as possible. We do not pursue legal action against researchers who report vulnerabilities in good faith.
Questions
Questions about our security practices? Reach us at hello@branddeck.co. We are happy to provide additional information for enterprise or agency customers with specific requirements.
