Access
Roles and permissions
Access to data and actions follows from the user's role and their responsibility in a specific process.
Security
We design security as part of the operational process.
Brillnet products help people work with data, decisions and evidence. Access control, action history and data minimisation are therefore part of the design — not an add-on after deployment.
Controls
Security layers in the products
We prefer simple mechanisms that can be explained to a process owner and checked in an audit.
History
Action trail
Material decisions, status changes and operations leave a readable record for later verification.
AI
Careful use of AI
AI features support the work; they do not decide. Where it matters, a human approval step remains.
Data
Data minimisation
We collect the data a process needs. We avoid gathering information without a clear purpose.
Operations
Resilient deployments
We assume failures and edge cases: input validation, logs, backups and a predictable rollback are part of the job.
Contact
Security questions
During onboarding we discuss concrete risks: integrations, access, retention, data location and the team's duties. Report a vulnerability or incident directly to security@brillnet-app.com — receipt confirmed within one working day.
Security evidence
A security pack available on request
A person assessing a supplier usually needs documents, not just declarations. During the onboarding conversation we go through the materials needed for a vendor risk review.
Documents
Data processing agreement and sub-processors
We provide a template data processing agreement and the list of providers that may take part in delivering the service.
Resilience
Backups and recovery
The backup model, service recovery and incident communication are confirmed for the specific scope of a deployment.
System
Management system status
The security management system is maintained as a process. Certification is not an active public offer; the document scope is confirmed after qualification.
Maintenance
How the product is maintained
Maintenance covers support, hosting, backups, security procedures and a development plan. The scope is confirmed at onboarding; responsibility for how the process is used stays with the customer.
Support
Support after launch
The customer gets an agreed contact channel for operational questions, reports and decisions about further development.
Procedures
Security and incidents
Before launch we discuss access, roles, personal data, exports and how incidents are handled.
Deployment
Remote support
Brillnet can support configuration, first scenarios and clarifying responsibilities, but process decisions stay with the customer.
Sources and limits of our claims
We verify practices; scope is confirmed per product.
Brillnet materials reference recognised sources such as the OWASP Application Security Verification Standard and the NIST AI Risk Management Framework. These are reference points — not a declaration of certification, nor of full compliance of every product with every requirement.