We build and operate digital systems for other people’s businesses, so the question of how we handle access, secrets, and data is a fair one to ask before the first engagement. What follows is what we actually run, verified rather than asserted, alongside a register of what we have not closed yet.
Compliance — readiness in progress
BMC holds no certification in any framework below. Readiness is in progress; the audit has not been performed yet. Controls are being brought to evidence one at a time, after which a single unified audit will be performed by an independent firm — Schellman and A-LIGN are the two we are weighing. Until that firm issues a report, everything here describes our own work, not a third party’s attestation.
- ISO/IEC 27001ReadinessInformation security management
- ISO/IEC 27017ReadinessCloud services security
- ISO/IEC 27018ReadinessPersonal data in the cloud
- SOC 2ReadinessSecurity, availability, confidentiality
- ISO/IEC 42001ReadinessAI management systems
- NIST AI RMFReadinessAI risk management
- GDPRReadinessEU data protection
- CCPAReadinessCalifornia privacy
Controls
Verified 25 July 2026.
- Full-disk encryption enforced on workstations
- Host firewall enabled on workstations
- TLS on all public surfaces, with HSTS and a hardened response-header set
- Multi-factor authentication required across the source-control organization
- Secrets centralized in a managed secret store; no plaintext secrets in source
- Secret push protection and secret scanning enabled organization-wide
- Application error monitoring with alerting
- Off-site backups on a scheduled cadence, encrypted in transit and verified present
- Source control mirrored one-way to separate off-site storage, daily
- Uptime monitoring with alerting on public surfaces
Open gaps
Most trust pages publish only what passes. This one publishes what does not, with what we intend to do about it. A control we cannot evidence is listed here instead of above.
BMC holds no ISO, SOC 2, or equivalent certification. Readiness work is underway and controls are being brought to evidence against the frameworks above, but no independent firm has examined us and no report exists.
Next: Controls are brought to evidence first, then a single unified audit is performed by an independent firm (Schellman or A-LIGN) covering the frameworks above rather than one engagement per standard. Certification marks and reports appear on this page when that firm issues them, and not a day earlier.
Public surfaces carry HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, but no CSP.
Next: Staged: report-only CSP first, tightened on collected violation evidence, then enforced. A rushed policy full of unsafe-inline would be worse than none.
The self-hosted database runs on a cloud server whose volume is not encrypted at rest. Our hosting provider's data processing agreement puts at-rest encryption for cloud servers on us rather than on them, and we have not implemented it yet. Data is encrypted in transit, the host sits behind an authenticated tunnel with no database port exposed to the internet, and the provider holds ISO 27001 and BSI C5 Type 2 certification covering physical and operational security of the facility. None of that is the same as encryption at rest, so we list it here rather than let the workstation line above imply it.
Next: Move the data volume onto an encrypted block device. This is a rebuild-and-restore rather than a toggle, so it is sequenced with the restore drill below — the drill proves the restore path that the migration depends on.
Off-site backups run on schedule to BMC-controlled storage and travel over an encrypted transport, but the archives themselves are not encrypted at rest and the destination volume is not an encrypted share. Physical control of that storage is the only thing standing behind it today.
Next: Encrypt the archives at creation so the protection travels with the file rather than depending on where it lands. Until that ships, this page will not use the word encrypted about backups at rest.
Off-site backups run on schedule and their presence is verified. A source-control restore drill was performed on 26 July 2026 — a repository was cloned back from the off-site mirror and its history matched the canonical remote exactly. Application-data restores have not been exercised on a recurring schedule.
Next: Both restore paths fold into a quarterly drill with the result recorded. Backups without a tested restore are a claim, not a control.
HSTS is live on all three domains with a one-year max-age and includeSubDomains. The preload token now serves on this domain; the other two carry it in configuration but have not shipped the deploy that puts it on the wire. No domain has been submitted to the browser preload list, and submission is not accepted until a domain is already serving the token.
Next: 8gnc.io and br8n.io go first as the lowest-churn domains. brandedmayhemcollective.com is held for a 30-day observation window and submitted around 25 August 2026 absent any HTTPS incident, because preload removal takes months rather than minutes.
Sub-processors
| Provider | Region | Purpose |
|---|---|---|
| Cloudflare | Global edge | Hosting, CDN, DNS, WAF |
| Hetzner | Nuremberg, Germany (EU) | Infrastructure hosting the self-hosted data plane |
| Convex (self-hosted) | Nuremberg, Germany (EU) | Application data |
| Anthropic | United States | AI processing |
| Google Workspace | United States | Email, calendar, documents |
| GitHub | United States | Source control |
| Doppler | United States | Secrets management |
| Resend | United States | Transactional email |
| Sentry | United States | Error monitoring |
| Stripe | United States | Payments |
| Sanity | United States / EU | Content management |
| Storyblok | European Union | Content management |
| UptimeRobot | United States | Uptime monitoring |
FAQ
Are you certified against any of these frameworks?
No. We are in readiness, not in audit: controls are being brought to evidence one at a time, and a single unified audit by an independent firm — Schellman and A-LIGN are the two we are weighing — follows that work. No firm has examined us yet, so no report exists. Anyone representing us as certified today is wrong, and we would rather you learn that here than in a questionnaire.
Can we get a Data Processing Agreement?
Yes. A DPA is available on request for any engagement that involves processing personal data, and is required before client data reaches any system we operate.
Do you use AI on client data?
Yes, and it is bounded. Internal work runs on subscription tooling. Client data is processed only under agreements that permit it, on accounts that carry the appropriate terms, and never on personal-tier accounts. br8n engagements end with the client owning the system rather than renting it.
Where is our data stored?
Application data runs on a Convex instance we self-host on our own EU infrastructure in Nuremberg, Germany. Public surfaces are served from Cloudflare's global edge. Backups and source-control mirrors are held on BMC-controlled storage in Richardson, Texas. The sub-processor list above names every third party that touches operational or client data.
How do we report a security issue?
Email [email protected]. We would rather hear about it directly and quickly than have it discovered elsewhere.