Security & Data Protocol

Brickwise AI Security and Data Protocol

1. Architecture and Regional Data Residency (US, UK & EU)

Brickwise Labs, Inc. (together with its UK affiliate Brickwise Labs Ltd, trading as Brickwise AI) operates dedicated regional data planes in the United States (app.brickwiseai.com) and the European Union / United Kingdom (eu.app.brickwiseai.com). Each organization is provisioned in a single regional environment so that portfolio databases, uploaded documents, and backups remain within your selected jurisdiction.

• Application and Edge Network: Hosted on Vercel with enforced HTTPS (TLS 1.2/1.3) and strict HTTP security headers (helmet, including frameguard: deny).
• Primary Database and File Storage: Managed PostgreSQL and object storage via Supabase with AES-256 encryption at rest, Row-Level Security (RLS), and automated backups.
• Background Compute and Key Management: Isolated container jobs on Google Cloud Run with deployment and runtime secrets protected by Google Cloud KMS (ENCRYPT_DECRYPT).

2. Multi-Tenant Isolation and Database Security

Every portfolio record in Brickwise is keyed to a unique organization_id UUID. Cross-organization data access is blocked at both the application API layer and the PostgreSQL database layer.

• Database Row-Level Security (RLS): Domain tables enforce PostgreSQL RLS policies (is_org_member and has_org_role) that restrict SELECT, INSERT, UPDATE, and DELETE operations to verified members of the target organization.
• Session-Scoped Query Guards: When Alice executes read queries in Computer Mode, the database transaction runs BEGIN READ ONLY with app.current_org_id locked to your organization and a strict 10s statement timeout. User-scoped queries also enforce SET LOCAL role authenticated with the caller's verified JWT claims.
• Anti-Tampering API Middleware: Every API route verifies session JWTs or organization API keys, enforces role permissions before execution, and rejects requests with conflicting organizationId values across headers, URL queries, or request bodies.
• PII Obfuscation Controls: Administrators can enable PII obfuscation in Organization Settings to mask sensitive resident contact details in the user interface.

3. Role-Based Access Control (RBAC)

Brickwise enforces granular role-based permissions across the web application, API routes, and database RLS policies:

• Admin: Full administrative control over organization settings, billing, team roles, integrations, API keys, and global AI configuration.
• Property Manager: Operational access to manage properties, units, leases, tenants, maintenance issues, and contractor coordination.
• Accountant: Access to financial ledgers, rent reconciliation, supplier bills, account codes, and landlord payouts, without maintenance mutation access.
• Leasing Agent: Scoped access to listed units, prospective tenant leads, screening, and viewing calendars.
• Field Operator: Restricted to submitting move-in and move-out inspection reports for assigned units via the mobile inspection application.
• Managing Agent: Restricted at the database RLS layer (supervisedReadPolicy) to viewing only the properties, units, leases, and issues where they are assigned as a supervisor.

4. Encryption and Credential Protection

Brickwise applies layered cryptography to protect portfolio data, third-party integration credentials, and programmatic API keys:

• Data in Transit (TLS 1.2 / TLS 1.3): Enforced across all web sessions, REST API requests, MCP streams, database connections, and webhooks.
• Data at Rest (AES-256): Applied to all PostgreSQL tables, write-ahead logs, point-in-time backups, and document storage buckets.
• Integration Credentials (AES-256-GCM): Third-party PMS, Xero, Slack, and OAuth refresh tokens are encrypted at the application layer before database storage using a 256-bit key, a unique 96-bit random initialization vector (IV) per write, and a 128-bit authentication tag. Disconnecting an integration immediately clears its encrypted_credentials value from the database.
• Organization API Keys (PBKDF2-HMAC-SHA256): API keys (sk_bw_...) are never stored in plaintext. Keys are salted and hashed with 100,000 PBKDF2 iterations and support expiration dates and last_used_at tracking.
• Infrastructure Secrets (Google Cloud KMS): Production environment secrets are encrypted via symmetric KMS keys restricted to least-privilege IAM service accounts.

5. AI Governance, Regulatory Compliance, and Human-in-the-Loop Controls

Alice operates within deterministic financial, legal, and operational boundaries configured by your organization:

• Zero Training on Customer Data: Brickwise never uses your portfolio records, resident personal data, uploaded documents, or call and message transcripts to train or fine-tune public or third-party foundation AI models.
• EU AI Act (Articles 14 & 50) & Call Recording Transparency: The platform supports configurable call and message greetings disclosing AI assistance (EU AI Act Article 50) and call-recording consent notices (supporting US two-party/all-party consent states and UK/EU GDPR).
• Fair Housing & Equality Guardrails: Alice's prompts and evaluation guardrails enforce objective communication in compliance with the US Fair Housing Act (FHA) and UK Equality Act 2010, prohibiting steering, discriminatory screening, or unauthorized legal commitments.
• Resident Identity Verification: Before disclosing lease terms, balances, or unit details on inbound calls or messages, Alice verifies the caller or sender against matched tenancy records.
• Spend Limits and Budget Caps: Administrators configure per-repair spend limits, monthly property budgets, and callout limits. Any contractor quote or invoice exceeding these thresholds pauses automatically for manager approval.
• Mandatory Human Approval Gates (EU AI Act Art. 14): Alice cannot move money, issue refunds, execute lease contracts, deduct security deposits, serve statutory eviction notices, or send mass tenant broadcasts without explicit human authorization.
• Confirm Before Acting in Computer Mode: Staff Computer Mode enables "Confirm before acting" by default, presenting a structured proposal card and waiting for staff confirmation before modifying records or sending external messages.
• Audit Trail: Every AI plan, tool call, action proposal, human approval or rejection, and outbound message is recorded in PostgreSQL (agent_logs, action_logs, agent_actions, interactions) with timestamps and actor attribution.

6. PMS Synchronization and Payment Isolation

Brickwise integrates alongside your existing property management and accounting systems (including AppFolio, Rent Manager, Alto, Guesty, OwnerRez, Buildium, and Xero):

• System of Record Preservation: Your PMS remains the primary system of record for properties, units, and lease terms, while Brickwise manages 24/7 communications, maintenance triage, viewing scheduling, and invoice extraction.
• Staged Import Preview: Bulk data imports run through a preview and validation workflow so administrators can inspect record mappings before committing changes.
• Payment Processing Isolation: Rent payment links, AutoPay, and landlord payouts run directly through Stripe Connect, and open banking feeds are read-only via Plaid. Brickwise never holds tenant or landlord funds in Brickwise-owned bank accounts.

7. Webhook Security, Monitoring, and Regulatory Frameworks

• Cryptographic Webhook Verification: All inbound partner webhooks validate signatures before processing, including Twilio (X-Twilio-Signature), Meta WhatsApp (X-Hub-Signature-256 with constant-time comparison), Resend (Svix-Signature), and ElevenLabs (ElevenLabs-Signature).
• Rate Limiting: Authentication and electronic signature OTP/session endpoints enforce request rate limits (express-rate-limit) against brute-force abuse.
• Telemetry Redaction: Error monitoring (Sentry in EU de.sentry.io) and product diagnostics (PostHog) automatically strip authentication tokens (token, token_hash) and mask personal data properties before transmission.
• Regulatory Alignment (UK, EU & US): Brickwise supports UK GDPR, Data Protection Act 2018, and PECR; EU GDPR, ePrivacy, EU SCCs, and the EU AI Act; and US CCPA/CPRA (Service Provider), TCPA/10DLC, and Fair Housing Act requirements. Data Processing Agreements (DPAs) incorporating the UK IDTA and EU SCCs are available upon request.
• Uptime, Backups, and Incident Notification: Automated monitors (BetterStack) track API and database health 24/7, backed by daily database backups and point-in-time recovery (PITR). In the event of a confirmed personal data breach affecting your organization, Brickwise notifies designated administrators without undue delay and within 48 to 72 hours.

For additional details, see our Privacy Policy, Terms & Conditions, and Cookie Policy, or contact privacy@brickwiseai.com and support@brickwiseai.com.