Security at BrokerStack

Your lead data, deal pipeline, and client information are critical to your business. We protect them with enterprise-grade security so you can focus on closing deals.

TLS 1.3

In-transit encryption

AES-256

At-rest encryption

SOC 2

AWS infrastructure

GDPR

Data rights support

99.9%

Uptime SLA

24/7

Monitoring

Encryption

All data is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption. Database connections are encrypted end-to-end. Call recordings, documents, and file uploads are stored in encrypted buckets with server-side encryption enabled by default. API keys and sensitive credentials are stored using hardware security modules (HSMs).

Data Isolation

Every BrokerStack organization operates in a logically isolated environment. Your leads, deals, call recordings, and team data are completely separated from other customers at the database level. Row-level security policies ensure that no user can access data outside their organization, even in the event of an application-level vulnerability.

Access Controls

Role-based access control (RBAC) lets you define exactly what each team member can see and do. Admins, managers, and reps each have distinct permission levels. Session management includes automatic timeout, IP allowlisting, and login attempt throttling. All authentication flows are protected against brute force, credential stuffing, and session hijacking.

Backups & Disaster Recovery

Automated daily backups are stored in geographically separate AWS regions. Point-in-time recovery is available for the last 30 days. Our disaster recovery plan targets a Recovery Point Objective (RPO) of 1 hour and a Recovery Time Objective (RTO) of 4 hours. Backup integrity is verified weekly through automated restoration tests.

Compliance

BrokerStack is built to support your compliance obligations. Our infrastructure runs on SOC 2 Type II and ISO 27001 certified AWS data centers. We maintain internal security policies aligned with SOC 2 requirements and undergo annual third-party penetration testing. Data handling practices are designed to support TCPA, CAN-SPAM, CCPA, and GDPR compliance for our customers.

Have security questions or need to report a vulnerability?