Scope
This policy applies to all botBrains systems that store or transmit business or customer data, across our cloud providers (AWS, Hetzner), the botBrains platform, and the laptops used to operate them.Encryption standards
botBrains applies strong, current cryptography by default and relies on provider-managed implementations rather than building our own.
We don’t use deprecated protocols or cipher suites. Public-facing endpoints offer TLS 1.3 and above and enforce a minimum of TLS 1.2 for older clients: employee and customer traffic reaches the API through the Hetzner load balancers, and the Vercel CDN serves static assets. Server-to-server traffic between the API and its downstream services stays within a private network or uses TLS 1.3 and above.
Key and certificate management
botBrains encrypts data at rest with customer managed keys in AWS KMS, which holds all durable application data. AWS KMS generates and stores the key material inside its hardened boundary, so keys never leave it, while botBrains owns each key and controls its policy and rotation. We don’t operate our own key management infrastructure.
Customers can find which providers and regions process their data, all within the EU, in the subprocessor list.