Infrastructure
- UK-region AWS (eu-west-2). All customer data resides in the UK.
- RDS Aurora cluster with point-in-time recovery.
- EFS for shared assets; encrypted at rest with AWS-managed keys.
- VPC with private subnets for the database tier; only the load balancer is exposed publicly.
Authentication
- Email + password with strict password policy and breach-list checks (HIBP API).
- A second factor on every sign-in: an emailed code, an authenticator app (TOTP) or a passkey (WebAuthn).
- Sign-in attempts are rate-limited, and emailed codes are single-use and time-limited.
Compliance
- FCA-aligned: we are not authorised by the FCA (we provide tools to firms that are), and we keep our role and limitations clearly documented.
- UK GDPR / Data Protection Act 2018: we are a data processor for case data, controller for account data. DPA available on request.
- MCOB record-retention: case-related data retained for the regulator-required period (currently 6 years post-completion); deletion requests handled per UK GDPR.
- Consumer Duty: every case-related output carries the audit trail needed for your firm's Consumer Duty file.
Responsible disclosure
If you find a security issue, email security@brokerbricks.com. PGP key on request. We commit to:
- Acknowledging within one working day.
- A status update inside seven days.
- Crediting reporters in the changelog (with permission) once an issue is fixed.
We do not run a paid bug bounty yet. We will note here if and when one starts.