Trust & Security

Security & Data Handling

Brama reviews sensitive materials — repos, builds, live web apps, and internal product assets. Here's exactly how we handle everything you share.

Your code stays yours

You retain full ownership of all code, assets, and product materials submitted. Brama does not claim ownership of, fork, republish, or redistribute any client materials under any circumstance.

Files removed after review

Uploaded artifacts — including APK/IPA files, screenshots, ZIP exports, and repository archives — are removed after review completion. We do not maintain permanent archives of client builds.

Not used to train AI models

Submitted materials are never used to train, fine-tune, benchmark, or improve any public or private AI model. Your code, business logic, UX flows, and product ideas are not training data.

Read-only GitHub access

If you choose to grant GitHub or repository access, it is always read-only. We do not request, accept, or use write, deploy, or admin permissions. Access can be revoked by you at any time.

Advisory only — no deployment

Brama does not deploy, modify, execute in production, or distribute your application code or build artifacts. Our reviews produce findings and recommendations. Implementation decisions are always yours.

Access revocable at any time

You can revoke repository, GitHub, or demo access at any time without affecting your relationship with Brama. We will notify you if revocation affects review scope or deliverables.

Confidentiality by default

All submitted materials are treated as confidential. We do not share, publish, or disclose client code, build files, product details, or findings to third parties without your explicit written consent.

Enterprise and regulated reviews handled separately

For healthcare, fintech, legal, and regulated applications, Brama applies additional handling protocols. Enterprise and custom reviews are scoped and confirmed in writing before any work begins.

Infrastructure Security

Encrypted file uploads over HTTPS/TLS

Restricted internal access to uploaded materials

Secure storage handling with limited retention windows

No public-facing access to submitted builds or source

Build Privacy

Uploaded builds are private and isolated per customer

Customer data is not shared across engagements

Files are not publicly accessible or redistributed

Builds are not reused for public AI model training

AI Usage Policy

Brama uses AI-assisted analysis as part of structured release intelligence workflows

Human review is applied at key decision points — findings are not fully automated

AI-assisted analysis supports, not replaces, expert review judgment

We do not claim autonomous auditing capability

Retention Policy

Uploaded artifacts are removed after review completion

Retention windows are temporary by default

Customer-initiated deletion requests are honored — contact hello@getbrama.com

Email correspondence is retained for support and audit record purposes

What we don't do

We do not sell client data to third parties

We do not use client materials for internal R&D beyond the engagement

We do not keep permanent copies of build artifacts or source code

We do not request write, deploy, or admin access to your repositories

We do not publish or share audit findings without your consent

We do not use demo or runtime access for any purpose beyond the agreed review

Responsible Disclosure

If you discover a security issue related to Brama's infrastructure or review process, contact us at security@getbrama.com. We take all reports seriously and respond promptly.

Have specific security requirements for your team, organization, or regulated app? Contact us at hello@getbrama.com before submitting and we'll walk through your requirements.