Security
Security built into every layer
BrikSync PropOS is defended in depth — at the edge, in the application, and inside the database. Everything on this page is implemented in the product today.
Infrastructure
- Hosted on Vercel and Supabase, which run on SOC 2-certified cloud infrastructure (AWS).
- All traffic served over TLS. HTTP Strict Transport Security is enforced in production.
- Strict Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options headers on every response.
Data protection
- Data encrypted at rest by the managed Postgres provider and in transit over TLS.
- Row-level security is enabled on every database table — the database itself enforces tenant isolation.
- Uploaded files are served through signed, expiring URLs; image EXIF metadata is stripped on upload.
- Sensitive errors are scrubbed of personal data before they reach our monitoring tools.
Access control
- A role-based permission model from account owner down to tenant, enforced at the middleware, server, and database layers.
- Multi-factor authentication is available to all users and required for privileged roles.
- Administrative and customer areas are isolated from each other at the edge.
Application security
- Every input is validated with strict schemas before it reaches the database.
- Cross-site request forgery protection on all state-changing requests.
- Outputs are escaped and spreadsheet formulas are neutralised on data export to prevent injection.
- Rate limiting on authentication and AI endpoints to blunt abuse and brute-force attempts.
Monitoring & audit
- An append-only audit log records security-relevant actions across the platform.
- Application errors and performance are monitored continuously via Sentry.
- A large adversarial test suite exercises authentication, access control, and injection paths on every change.
Reporting a vulnerability
If you believe you have found a security issue, please email hello@errsol.com with details and steps to reproduce. We will acknowledge your report and keep you updated. Please do not publicly disclose an issue until we have had a chance to address it.