Brantial
Get Audit

COMPANY / TRUST CENTER

Procurement Answers, Published Before the Sales Call

A security page is not a list of promises; it is an auditable status statement. Data residency, sub-processors, certification status and deletion timelines are published below with dates and scope. Write to security@brantial.com for control documentation under NDA.

TR/EU Data residency — customer data never leaves the region
%99,96 Measured uptime over 12 months, against a 99.9% target
48 hrs Standard DPA turnaround
30 days Full-deletion SLA on written request
PRODUCT VIEWFrom the live product interface
Measured UptimeLast 12 months
%99,96TARGET 99.9%
UpMaintenance
The Data LifecycleFour auditable stages
Collect: connected properties onlyOK
Process: eu-central-1OK
Retain: 13–25 monthsRUN
Delete: 30-day SLA
Certification StatusRefreshed quarterly
KVKKOK
GDPROK
ISO 9001OK
SOC 2 IIIN PROG.
DPA TurnaroundStandard enterprise request
48 hrs
SCCS INCLUDED

DATA LIFECYCLE

Your Data in Four Stages, Each One Auditable

Customer data is never used for model training at any stage.

01

Collection

Only answer-engine responses, data from the properties you connect (GSC, GA4) and the configuration you enter are collected. No visitor tracking, pixels or fingerprinting.

02

Processing

Processing runs in AWS eu-central-1 (Frankfurt). Model API calls operate under zero-retention agreements; submitted content is not stored by the provider.

03

Retention

Raw answer data is retained for 13 months and aggregated scores for 25; the periods are written into the plan contract and customisable on Enterprise.

04

Deletion

Self-service deletion from the console is immediate; on written enterprise requests, full deletion including backups is confirmed in writing within 30 days.

SUB-PROCESSORS

Everyone Who Touches Your Data Is on This List

AWS Frankfurt

AWS (eu-central-1, Frankfurt) — hosting and storage; the single physical location of customer data.

Engine APIs

OpenAI, Anthropic, Google — answer-engine APIs, all under zero-retention terms, prompt submission only.

Stripe

Stripe — payments; card data never reaches Brantial infrastructure.

Postmark

Postmark — transactional email (alerts, reports), kept separate from marketing lists.

Slack

Slack — only if you enable the alert integration, scoped to a single channel.

The 30-day Rule

Every change to this list is announced by email 30 days in advance, with a contractual right to object.

CERTIFICATION STATUS

Where We Stand, by When, and in What Scope

This table is refreshed every quarter. Last updated: August 2026.

FRAMEWORK
STATUS
SCOPE
NOTE
KVKK
Compliant
All TR customer data
VERBIS-registered, privacy notice standard
GDPR
Compliant
All EU/UK data
DPA and SCCs included
SOC 2 Type II
Audit in progress
Platform and infrastructure
Target Q1 2027; controls shared under NDA
ISO 9001
Certified
Webtures group processes
Held since 2011
SSO / SAML
Live
Enterprise
Okta, Azure AD, Google Workspace

See Where Your Brand Stands Today

The free audit needs no card and sets up in four minutes. The result screen shows your score and the first three fixes.