Privacy policy

1. Information we collect

• Booking a scoping call. When you use the assessment form, the name, email and details you enter are passed to Calendly, which schedules the call. We receive them from Calendly.
• Client portal accounts. Accounts are created by Brexa for our clients. We store each person's name, job title, username, an optional email address, their role in the portal, a securely hashed password, and their two-factor settings.
• Engagement records. Findings, assets in scope, reports, messages and approvals that Brexa and the client create in the portal.
• Security and activity records. Sign-in attempts, the IP address they came from, and actions taken in the portal (for example a finding being updated or a report downloaded) are recorded in an audit log so every change can be traced.
• Technical information. Our hosting provider processes standard request information such as IP address and browser type to deliver and protect the site.

We do not use advertising or analytics trackers on this website, and we do not sell personal information.

2. How we use it

• To schedule and prepare scoping calls and engagements.
• To provide the client portal: signing in, showing each client only its own records, and delivering findings and reports.
• To keep accounts secure, investigate misuse, and keep a reliable record of who did what.
• To meet legal obligations.

3. Cookies

We only use cookies that the site needs to work:

• a session cookie that keeps you signed in to the portal or admin console;
• a cookie that remembers which workspace you chose, if you belong to more than one;
• a cookie that opens the public portal demo when you choose to view it.

The booking form loads Calendly, which may set its own cookies under its own policy.

4. Who we share it with

We share information only with service providers that run the site for us, under their own security and privacy commitments:

• Vercel, which hosts the website and portal;
• Neon, which hosts the portal database;
• Calendly, which schedules scoping calls.

We may also disclose information when required by law. Client findings are never shared with anyone outside the client and the Brexa team working on that engagement.

5. How we protect it

• All traffic is encrypted in transit (HTTPS).
• Passwords are stored only as secure hashes, and two-factor authentication is available on every account.
• Every portal request is checked on the server so that each client can only reach its own organization's records.
• Brexa staff access is limited to the clients they are assigned to, and staff actions are recorded in the audit log.

6. How long we keep it

Engagement records and portal accounts are kept for the duration of the client relationship and afterwards for as long as the client agreement requires, or as needed for legal and audit purposes. A client may ask us to delete its workspace at any time, subject to those obligations.

7. Your choices and rights

You can ask to see, correct or delete the personal information we hold about you. Portal users can also change their password and two-factor settings from the Settings page. Depending on where you live, you may have additional rights under local privacy law.

8. Contact

Questions or requests: assessment@trybrexa.com. If we change this policy, we will update the date at the top of this page.