Yes, if you ask for it when the workspace is opened. Pinning a workspace to our Frankfurt region keeps every profile, event and delivery log written from that point inside the EU. Backups and the search index replicate within the same region, and only on-call engineers based in the EU can reach the machines holding them.
Anything that degrades sending or reporting is posted to our public status board at status.brackwater.io, usually within four minutes of detection.
Card numbers for a paid Brackwater subscription never pass through or rest on our own machines. Payment capture is handed to a specialist processor that is certified at PCI Service Provider Level 1, the strictest tier available, and its attestation of compliance is published each year.
Of course — the current Brackwater DPA is on the legal centre to read or download. There is a longer note there on how GDPR applies to Brackwater, alongside a summary of our security practice.
Our reliability group triages every report that reaches us, normally the same working day. If you think you have found a flaw in Brackwater, write to security@brackwater.io with enough detail to reproduce it and we will acknowledge you quickly. We ask that the finding stay private until a fix has shipped and the reliability group has confirmed it.
The full ground rules live on our responsible disclosure page.
Brackwater does not hold an active ISO 27001 certificate today. The controls we run are modelled on that standard, we keep an information security policy and a standing committee behind it, and a formal audit is on the roadmap rather than off the table.
Everything sent to Brackwater, including calls to the API, travels over TLS and is refused if it does not.
Data at rest is encrypted with keys held in a managed key service and rotated on a fixed schedule.
Want the finer detail on how we treat privacy and security? Read through the legal centre, or write to our counsel directly at legal@brackwater.io.