BBrimScout
Sign in

Security

Last updated: October 14, 2026
Effective date: October 14, 2026

This page says what is true about BrimScout's security today, and what we do not have yet. BrimScout is operated by BRIMSCOUT LLC, a small company.

What is in place today

  • Hosting. The website, the client app and the app database run on Cloudflare (Cloudflare Workers and Cloudflare D1).
  • Encryption. The site is served over HTTPS. Cloudflare states that D1 encrypts stored data with AES-256 and that traffic between our app and the database is encrypted with TLS. Encryption at rest is provided by Cloudflare, with keys managed by Cloudflare.
  • Passwords. Passwords are never stored. We store only a salted hash (PBKDF2 with SHA-256 and 100,000 iterations).
  • Sessions. Sign-in uses a signed cookie that scripts on the page cannot read, that is sent only over HTTPS, and that expires after 14 days. Resetting a password signs out every session for that login.
  • Sign-in limits. After 5 failed attempts from one IP address or for one email address within 15 minutes, further attempts are blocked for a while. We record failed attempts as one-way hashes, not raw IP or email addresses.
  • Accounts. We create client logins ourselves; there is no open sign-up. Each login can see only the client accounts assigned to it, and the AI chat can read only the accounts the user is viewing.
  • Form protection. Our forms reject requests sent from other websites.
  • Secrets. API keys and signing keys are kept out of our source code.
  • Less data to protect. Our app database does not store buyer names, addresses or contact details, and we never collect payment card numbers.
  • Request logs off. Request logging for our app is turned off in our Cloudflare configuration, so sign-in form contents are not written to logs.
  • Changes need approval. Changes to client ad accounts need the client's approval and respect the client's Limits, and every Change is recorded with its reason and its before and after values.
  • Backups. Cloudflare keeps a restore history of the database for up to 30 days.

What we do not have yet

  • Multi-factor authentication. Sign-in uses email and password only. Multi-factor authentication is not available yet.
  • Certifications. BrimScout has no SOC 2, ISO 27001 or similar certification of its own. Cloudflare's certifications cover Cloudflare's infrastructure, not BrimScout.
  • Independent testing. BrimScout has not yet had an independent security assessment or penetration test.
  • Data preparation. Some data preparation runs on a company computer, which holds working copies of client data. That computer is covered by this page's deletion commitments but has not been independently assessed.

We will update this page when any of this changes.

Incidents

If we detect a security incident affecting client data, we contain and investigate it, notify affected clients, and notify the platforms involved as their terms require, including Amazon within 24 hours when Amazon information may be involved. We follow a written incident response plan, review it every six months and practice it at least once a year. The details are on our Data Processing page. To report a security issue, email security@brimscout.com.

Report a security issue

If you think you have found a security problem in BrimScout, email support@brimscout.com with "Security" in the subject line. Please do not access other people's data or disrupt the service while testing. We will reply, keep you informed, and fix confirmed problems as quickly as we can.

Keeping your account safe

  • Use a long, unique password for BrimScout, and do not reuse it on other sites.
  • Do not share your login. Ask us for a separate login for each person.
  • When someone leaves your team, tell us so we can remove their login, and remove their access in each platform too.