Security

The Services are hosted on Amazon Web Services (AWS), which maintains leading physical and environmental security controls and independent certifications including ISO 27001 and PCI DSS.

Personal Data is encrypted in transit (TLS) and at rest using strong, industry-standard algorithms (e.g., AES-256). Encryption keys are managed and access-controlled.

Access to Personal Data is restricted on a least-privilege, role-based basis. Multi-factor authentication is required for administrative access, and access rights are reviewed periodically.

Appbrew employs network security controls and continuous monitoring, including logging, anomaly detection, and alerting, to detect and respond to potential security incidents.

Personal Data is backed up regularly across redundant, geographically separated locations. Appbrew maintains disaster recovery and business continuity plans with defined recovery objectives, and tests them periodically.

Appbrew performs regular vulnerability scanning and applies security patches on a prioritised basis. Independent penetration testing is conducted at least annually and after significant changes.

Appbrew maintains a documented incident response plan, including breach notification procedures, and tests it through exercises and post-incident reviews.

Personnel with access to Personal Data are bound by confidentiality obligations and receive ongoing security-awareness and phishing training.

Third-party sub-processors are assessed for appropriate security practices and are contractually bound to data protection and security obligations.

For our current list of sub-processors, see appbrew.com/subprocessors. For data-processing terms, see appbrew.com/dpa.