Our Security Posture and Processor

™Bravofolio adheres to industry-leading security standards to ensure the privacy and safety of user data. The platform employs encryption both in transit and at rest to protect sensitive information. We also adhere to best practices for access control and authentication, ensuring that only authorized users can access specific features and data. Additionally, we conduct regular security audits and monitoring to identify and address potential vulnerabilities. Our system is designed to protect both personal and academic data and to ensure compliance with applicable privacy laws, such as the Family Educational Rights and Privacy Act (FERPA) for educational institutions.

In terms of secure coding practices:

  • Input Validation & Output Escaping: We ensure that user input is properly validated and sanitized to prevent injection attacks.
  • Cross-Site Scripting (XSS) Protection: ™Bravofolio safeguards against XSS attacks by escaping user input and preventing malicious scripts from executing.
  • Session Security: Session data is securely stored and transmitted using secure session management practices, ensuring that user sessions cannot be hijacked.
  • HTTPS Everywhere: Bravofolio uses HTTPS for all communications to encrypt data transmitted between the platform and users, ensuring protection against man-in-the-middle attacks.
  • Error Handling: We implement proper error handling to prevent sensitive data from being exposed in error messages, ensuring that security information is not leaked to unauthorized users.

These security measures are continuously reviewed and updated to maintain the highest standards of protection for all users.

Never share passwords, PINs, or one-time verification codes. ™Bravofolio will never ask for them.

Below is the subprocessor information for our cloud hosting, data storage, and infrastructure services.

Processor

Scala Hosting LLC
Role: Provides and operates the virtual server, the SPanel control panel, server management, and backup services. All servers are Scala Hosting-owned hardware administered exclusively by our staff.

Subprocessor – data-center / colocation services

TierPoint, LLC
Role: Operator of the physical data-center facility housing the Seattle server cluster. TierPoint provides the facility, power, cooling, network connectivity, and physical security. TierPoint personnel have no logical access to your server or the data on it.
Processing location: Seattle, Washington, USA
Facility compliance: SSAE 18 SOC 1 and SOC 2 Type II, PCI-DSS, HIPAA, GLBA, NIST

Backups
Automatic offsite backups of your server are stored on Scala Hosting-operated infrastructure located in [Sofia, Bulgaria]. No third party other than the data-center operator above is involved in backup storage.

No other third parties are engaged for hosting, storage or infrastructure of your service. Our hosting-related processing is limited to the above; any analytics, billing, or support tooling we use for our own operations does not involve the content hosted on your server.