Security
Your audit findings are yours alone
Internal-audit data is among the most sensitive information an organisation holds. Brahvex is designed so that only your own people can see it.
Encryption with your own key
Every evidence file, attachment, dataset and report is encrypted with AES-256-GCM using a key that belongs to your organisation alone, before it is written to disk. Connections use TLS 1.2 or 1.3.
Access for your users only
Every record is tied to your organisation, and every request is checked against it. Auditees see only what is issued to them; the Audit Committee sees board packs, not working papers.
You control support access
Brahvex staff cannot open your audits, observations or files. If you need help, your administrator can grant support access — and withdraw it at any time. Everything done under it is recorded in your audit trail.
Append-only audit trail
Sign-ins, changes, downloads and messages are logged with user, time and IP address. A database rule prevents anyone from editing or deleting the log.
Strong sign-in
Two-factor sign-in with Google or Microsoft Authenticator, lockout after five failed attempts, secure session cookies, and temporary passwords that must be changed at first sign-in.
AI that stays on the server
Speech-to-text and the language model that polishes observations run on Brahvex servers, not on outside AI services. Your notes and recordings are not used to train anyone's model.
Support access
You decide who can see your data
Your administrator sees your subscription, your users and who can open your organisation's data. Support access stays closed unless your administrator opens it, and they can close it again at any time.
- Closed by default for every subscriber
- Opened and closed only by your own administrator
- Every action under support access is recorded in your audit trail
Deployment choices
Cloud subscription or your own servers
Most organisations use Brahvex as a subscription. If your policy requires audit data to stay in your own data centre, Brahvex can be installed there instead — including on servers without internet access.
- Subscription: sign in at app.brahvex.com; your data is separated and encrypted per organisation
- On-premise: installed in your data centre or private cloud, managed with your IT team
- Encrypted backups that never contain the master key
- Designed to support your obligations under India's Digital Personal Data Protection Act, 2023
Questions from IT and security teams
Frequently asked
Where is our data stored?+
On Brahvex's servers for subscriptions, or on your own servers for on-premise installations. Ask us for the current hosting location and provider for subscriptions.
Can Brahvex staff see our data?+
No. Your data is visible only to your organisation's users. Our support team can open it only if your administrator grants support access, and every action taken is recorded in your audit trail.
Do you use outside AI services?+
No. Speech-to-text and text polishing run on the Brahvex server. Your recordings are not stored, and nothing is sent to third-party AI services.
What happens to our data if we leave?+
Your data remains yours. On request we export it and then delete your organisation's data and destroy its encryption key, as set out in the subscription terms.
Can we review your security documentation?+
Yes. Write to us and we will share the security overview for your IT and information-security teams.
See Brahvex on your own audit plan.
A walkthrough on sample data from your industry: audit universe, analytics, re-credit and the board pack.