Security

• Least privilege. Each tool asks only for the scopes its functions need; scopes are listed on its page and justified in the store's review.
• Data minimisation. Where possible, tools run inside the platform (Apps Script, the IDE, Apify) and store nothing on our servers. When a backend is needed, it stores only configuration, licence status and the platform access tokens it needs.
• Encryption. All traffic uses TLS. Everything we store sits in storage the hosting platform encrypts at rest (Cloudflare D1, Google's per-user add-on storage). Third-party API keys you give us, such as a Click & Drop key, are additionally encrypted with AES-256-GCM under a key held in the platform's secret store.
• No content logging. Logs hold errors and request metadata, never email, page or order content.
• Dependencies. A weekly scan of every product's dependencies against published advisories; high and critical issues are fixed within 7 days.
• Access. One operator; 2-step verification on every account; no shared credentials.
• Incidents. We notify affected customers without undue delay and within 48 hours of becoming aware of a breach affecting their data.
• Reporting. Report vulnerabilities to security@brisaworks.com. We reply within 3 business days and credit reporters who wish it.

Details, including the incident response steps: data protection and incident response.