Your brand guide is confidential. We built for that first.
Brandwarden touches three sensitive things: your guide, your fonts, and the content your team writes. Here is exactly what happens to each.
The brand guide
- Uploaded over TLS to storage scoped to your organization.
- Processed by Brandwarden's compiler. AI reading requires explicit approval; the selected page images and text are sent to the configured extraction provider, and the reading is recorded. Brandwarden does not use customer content to train models.
- Never quoted in application logs. Log lines carry counts and identifiers, not text.
Fonts
- Font uploads are encrypted at rest with a per-deployment key and scoped to the workspace.
- The upload license attestation does not authorize distribution. An owner must separately approve distribution rights before a font file can be supplied to a connected assistant.
- Approved asset downloads use short-lived links. The receiving host or viewer must support the font; its own storage and privacy policies also apply.
Deck and document content
- Content submitted to Brandwarden is processed for the requested build or check. Built files and thumbnails are available for 30 days by default, then expire and are removed by retention housekeeping.
- A request refused before building because of capacity or plan limits may be saved with its full input for up to 30 days. Its input is cleared when resumed, discarded or expired. This can include a request for which no file was produced.
- Receipts, hashes and certificates remain as records. Content that stays in ChatGPT or Claude follows that host's own policies.
- Certificates contain no document text: organization, brand name, brand version, policy, checks passed, content hash and per-slide hashes.
Accounts and access
- Console sign-in uses email and password (scrypt-hashed) with HttpOnly, SameSite cookies.
- The connector uses OAuth 2.1 with PKCE, dynamic client registration and audience-bound tokens (RFC 8707). Refresh tokens rotate.
- Owners manage billing and publication, admins prepare the brand and connections, and members connect and verify files and use the brand rules and assets their workspace permits.
- Reading, review, publication, build and connection records provide an audit history with counts and identifiers rather than document text.
Tenant isolation
Every database query and storage key is scoped by organization; automated tests assert that one organization cannot read another's assets, specs or certificates.
Certificates
Ed25519 signatures over a SHA-256 hash of canonicalized content parts (slides for PPTX; document, headers and footers for DOCX; page content for PDF). The public key is published at /.well-known/brandwarden/keys.json, so verification works offline and without an account.
Payments
Card details go directly to Stripe; Brandwarden never sees or stores them. We keep the customer and subscription references needed to show your plan.
Reporting a vulnerability
Email security@brand-warden.com. We acknowledge within two business days.