Security at Brickly

Our approach

Brickly uses administrative, technical, and organizational safeguards designed to protect personal information and investor records. We limit the data we collect to what the platform needs to operate, and we control access to it on a need to know basis.

Technical safeguards

All traffic is encrypted in transit over HTTPS. Stored data is encrypted at rest by our database provider. Passwords are never stored in plain text; credentials are handled by a dedicated authentication service with modern hashing.

Investor records are isolated with row level access controls, so each account can only read its own holdings and distributions. Privileged actions require server side authorization checks, and administrative access is restricted.

Data minimization

We do not store full bank credentials, card numbers, or raw identity documents on our own systems. Where identity verification or payments are needed, we rely on established third party providers that specialize in those services.

Operational practices

Access to production systems is limited and logged. We apply security updates to our dependencies, separate development from production, and review changes before they ship. No method of transmission or storage is guaranteed to be completely secure, but we apply measures appropriate to the sensitivity of the data we hold.

Report a vulnerability

If you believe you have found a security issue, please report it responsibly to security@bricklyinvesting.com. We ask that you do not access or modify data that is not yours, do not disrupt the service, and give us a reasonable window to investigate and fix the issue before any public disclosure. We will acknowledge reports and keep you updated.

Questions

General security questions can be sent to hello@bricklyinvesting.com. For how we handle personal data, see our Privacy Policy.