Security Policy

StorBrain implements industry-standard security practices and continuously monitors and improves our security posture to protect your business data.

• Hosted on Vercel enterprise infrastructure with global CDN and DDoS protection
• Database stored in Neon PostgreSQL with encryption at rest and automatic backups
• TLS 1.2+ encryption for all data in transit, AES-256 at rest
• Complete business account isolation — cross-account access architecturally impossible
• Payment data processed exclusively by Stripe (PCI DSS Level 1 certified)

• Role-based access control (RBAC) — employees access only what their role permits
• HTTP-only secure session cookies protecting against XSS
• CSRF protection on all form submissions
• Account lockout after 5 failed login attempts (30-minute lockout)
• PIN-based secondary authentication for cashier functions
• Time-based and location-based access restrictions for employees
• Complete audit log of all platform activity

• 24/7 automated security monitoring
• Anomaly detection for unusual access patterns
• Failed login attempt tracking and alerting
• Regular security reviews and vulnerability assessments

In the event of a security incident: we investigate and contain immediately, notify affected users within 72 hours, take remediation steps, and cooperate with law enforcement as required.

Report security vulnerabilities to: legal@storbrain.com

• Use strong, unique passwords for your account
• Do not share login credentials with unauthorized individuals
• Log out when using shared devices
• Report suspicious activity immediately
• Keep payment information current
• Revoke access for departing employees promptly