---
title: "Procurement Answers, Published Before the Sales Call | Brantial"
description: "A security page is not a list of promises; it is an auditable status statement. Data residency, sub-processors, certification status and deletion timelines are published below with dates and scope. Write to security@brantial.com for control documentation under NDA."
source_url: "https://brantial.ai/trust/"
lang: "en"
---

COMPANY / TRUST CENTER

# Procurement Answers, Published Before the Sales Call

A security page is not a list of promises; it is an auditable status statement. Data residency, sub-processors, certification status and deletion timelines are published below with dates and scope. Write to security@brantial.com for control documentation under NDA.

[Write to security](https://brantial.ai/contact/) [Book a demo](https://brantial.ai/contact/)

**TR/EU** Data residency: customer data never leaves the region

**%99,96** Measured uptime over 12 months, against a 99.9% target

**48 hrs** Standard DPA turnaround

**30 days** Full-deletion SLA on written request

DATA LIFECYCLE

## Your Data in Four Stages, Each One Auditable

Customer data is never used for model training at any stage.

01

### Collection

Only answer-engine responses, data from the properties you connect (GSC, GA4) and the configuration you enter are collected. No visitor tracking, pixels or fingerprinting.

02

### Processing

Processing runs in AWS eu-central-1 (Frankfurt). Model API calls operate under zero-retention agreements; submitted content is not stored by the provider.

03

### Retention

Raw answer data is retained for 13 months and aggregated scores for 25; the periods are written into the plan contract and customisable on Enterprise.

04

### Deletion

Self-service deletion from the console is immediate; on written enterprise requests, full deletion including backups is confirmed in writing within 30 days.

SUB-PROCESSORS

## Everyone Who Touches Your Data Is on This List

### AWS Frankfurt

AWS (eu-central-1, Frankfurt), hosting and storage; the single physical location of customer data.

### Engine APIs

OpenAI, Anthropic, Google: answer-engine APIs, all under zero-retention terms, prompt submission only.

### Stripe

Stripe: payments; card data never reaches Brantial infrastructure.

### Postmark

Postmark: transactional email (alerts, reports), kept separate from marketing lists.

### Slack

Slack: only if you enable the alert integration, scoped to a single channel.

### The 30-day Rule

Every change to this list is announced by email 30 days in advance, with a contractual right to object.

CERTIFICATION STATUS

## Where We Stand, by When, and in What Scope

This table is refreshed every quarter. Last updated: August 2026.

FRAMEWORK

STATUS

SCOPE

NOTE

KVKK

Compliant

All TR customer data

VERBIS-registered, privacy notice standard

GDPR

Compliant

All EU/UK data

DPA and SCCs included

SOC 2 Type II

Audit in progress

Platform and infrastructure

Target Q1 2027; controls shared under NDA

ISO 9001

Certified

Webtures group processes

Held since 2011

SSO / SAML

Live

Enterprise

Okta, Azure AD, Google Workspace

RELATED

## Three More Sources for Your Audit File

The status page and incident history are shared on request.

SECURITY

### Contact

security@brantial.com; first response within 4 hours for critical reports.

[Contact](https://brantial.ai/contact/)

RECORD

### Changelog

Infrastructure and data-processing changes are published weekly.

[Changelog](https://brantial.ai/changelog/)

COMPANY

### About

Corporate structure: Brantial is a Webtures LTD (Istanbul/London) product.

[About](https://brantial.ai/about/)

## See Where Your Brand Stands Today

Your analysis credit takes about four minutes to set up. The result screen shows your score and the first three fixes.

[Audit my brand](https://brantial.ai/brandscore/) [Talk to sales](https://brantial.ai/contact/)