> For the complete documentation index, see [llms.txt](https://brd-digital.gitbook.io/brd-digital-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://brd-digital.gitbook.io/brd-digital-docs/compliance/data-security.md). # Data Security How accounts, sessions and data are protected: mandatory MFA, bounded sessions, hardened transport, controlled destinations, and audit trails. The platform is engineered on one assumption: credentials eventually leak. The controls below exist so that when that happens, nothing of value follows. ## Account security * **Two-factor authentication is mandatory** for every account — a TOTP authenticator, set up at activation, with one-time backup codes shown once and never emailed. * **A password alone reaches nothing.** Before the second factor is verified, a session cannot read balances, transactions, or account data. * **Passwords are strong by policy** — minimum 12 characters, screened for strength and for reuse — and **sign-in attempts are rate-limited** with escalating lockout, per account and per source. ## Session security * Sessions are short-lived and silently refreshed while you work, end on inactivity, and are capped by an absolute maximum regardless of activity. * Session cookies are host-bound (`__Host-` prefix), HTTP-only and TLS-only; state-changing requests additionally carry a CSRF token, checked on every mutation. * Signed-in pages are marked non-cacheable and excluded from search indexing. ## Funds-movement controls * Withdrawal destinations — bank accounts and wallet addresses — are **registered and approved before use**. A compromised session cannot add a new destination and drain to it; see [Connect a Wallet](/brd-digital-docs/getting-started/connect-a-wallet.md). * Every privileged action is written to an **append-only audit trail**. ## Platform and data handling * Transport is TLS-only with strict transport security; the application ships a strict content-security policy and hardened response headers. * Secrets are managed in a cloud key-management service, not stored in configuration. * Your KYB/KYC records live off-chain in access-controlled systems. On-chain there are token balances and transfers — never identity data. See [What is on-chain and what is not](broken://pages/0W0WbW55JnZ1jpWOOEy0#what-is-on-chain-and-what-is-not). ## Reporting a security concern If you believe you have found a vulnerability, or observe suspicious activity on your account, contact immediately and include enough detail to reproduce or investigate. Do not test against production accounts holding real balances. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://brd-digital.gitbook.io/brd-digital-docs/compliance/data-security.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.