Security and trust.
Brewless deploys and operates applications in your own cloud accounts. It is not in the path of your visitors and keeps no copy of your application's data. This page says what we do hold, how it is protected, and how that lines up with the rules your own organisation may fall under.
No certificate is claimed anywhere on this page. Where a standard is named, it is the frame our measures are arranged by. Version of 8 October 2026.
ISO/IEC 27002:2022
The measures on this page follow the controls of the international standard. Not a certification: a systematic frame.
NIS2 and the Cbw
Arranged by the risk management measures of NIS2 Article 21, so a customer under the directive can show its supply chain is in order.
GDPR
A data processing agreement under Article 28, security under Article 32, breach notification under Article 33.
EU AI Act
Brewless has no AI functionality. Nothing you put into it is sent to an AI model.
Hosting and infrastructure
Brewless runs on what it offers: in the European Union, at European providers. What we hold is not transferred outside the European Economic Area.
Scaleway
Paris, FranceThe containers, the database and the secrets of Brewless itself.
bunny.net
Slovenia; EU points of presenceEdge, DNS and certificates for brewless.eu, routed through the European Union only, with visitor addresses made anonymous in its logs.
Lettermint
European UnionDelivery of sign-in mails and invitations.
Your application, its database, its files and its visitors are in your own Scaleway project and your own bunny.net account, under your own agreements with them. Brewless is never a hop for your visitors' traffic.
What Brewless holds, and what it never does
The less we hold, the less there is to protect. Brewless keeps references and names, and leaves the rest where it belongs: in your accounts.
Encryption and secrets
In transit
Every connection is over TLS. HSTS tells a browser never to try without.
Provider keys at rest
Encrypted with AES-256, with a key that is not in the database.
No passwords
There is none to leak or reuse: you sign in with a link or code sent to your address, or with a passkey.
Hashes only
Sign-in links and codes, invitations and command line tokens are kept as a keyed hash (HMAC-SHA-256), never as the secret itself.
In the browser
A content security policy with a nonce per request, no framing by other sites, no content sniffing, a strict referrer policy and no cross-origin access to the API.
Access
Roles per organisation
Owner, admin and member. Members see; owners and admins change. The server decides, never the browser.
A database per organisation
Each organisation has its own database and its own subdomain, so one organisation cannot reach the records of another.
An audit trail you can read
Every change, every sign-in and every failed sign-in is written to a ledger whose lines cannot be changed afterwards.
Our own access
The Brewless admin only opens with a passkey. Multi-factor authentication is on for every account Brewless is managed with: Scaleway, bunny.net, GitHub, Lettermint and Mollie.
The command line
A machine signs in with a code you approve in the console and gets a token of its own, valid for 90 days and revocable at any time.
Limits on guessing
Sign-in attempts are limited per address and per visitor, and five wrong codes end a sign-in request.
How Brewless is built
Checked on every push
Static analysis (Larastan level 9), a formatter and the automated test suite run on every push. A failing check stops the release.
Dependencies watched
The pipeline fails on a known vulnerability in a package that ships, in PHP and in the browser.
A security audit every year
The code is reviewed against the OWASP Top 10 at least once a year. Last audit: 7 October 2026, with no critical or high findings.
Nothing destructive by accident
Nothing at your providers is removed as a side effect. What Brewless changes, it changes on your instruction and records.
Source code
In private repositories at GitHub, with no customer data and no secrets in them. The command line client and the package that runs inside your application are open source.
Back-ups and continuity
Every day
The database of Brewless itself is backed up daily at Scaleway.
Kept for 30 days
Back-ups are kept for 30 days, in the European Union.
Without Brewless
Your application does not need Brewless to run. If Brewless is down, nothing of yours is: only deploying, scaling and looking have to wait.
You can export everything Brewless knows about an environment, with Terraform that takes its resources over as they are, and detach at any moment. Back-ups of your own database are yours: they are set at your provider, in your account.
Privacy and GDPR
Data processing agreement
For the personal data Brewless can come across in your accounts when it works on your instruction (Article 28). It is published as a draft, still to be reviewed by a lawyer.
No profiles, no selling
There is no advertising on brewless.eu. Visits to the public pages are counted with ClearAnalytics, without cookies and without following you, and no data is sold or shared for marketing.
Your rights
To see, correct, remove or take along your data: write to us and we answer within a month.
Privacy statement Data processing agreement Terms of service
NIS2 and the Cyberbeveiligingswet
The European NIS2 directive (2022/2555) requires essential and important entities to have their cybersecurity demonstrably in order, their supply chain included. In the Netherlands it is implemented by the Cyberbeveiligingswet.
Coding Agency, which makes Brewless, is too small to fall under the directive itself. Customers of Brewless may well fall under it. This table maps what Brewless does to the measures of Article 21(2), so you can add it to your supplier file.
| Article 21(2) | How Brewless fills it in | Where |
|---|---|---|
| a) Risk analysis and policy | A yearly security audit of the code against the OWASP Top 10, with findings tracked until they are closed. | How it is built |
| b) Incident handling | A fixed procedure: contain, tell the customer without delay, report where the law requires it, evaluate. | Incidents |
| c) Business continuity and back-ups | Daily back-ups kept for 30 days. Your application runs without Brewless, and everything Brewless knows can be exported. | Back-ups and continuity |
| d) Supply chain security | A short list of processors, all established in the European Union. Your own providers stay under your own agreements. | Processors |
| e) Security in development and maintenance | Static analysis, automated tests and a dependency audit on every push; nothing destructive as a side effect. | How it is built |
| f) Assessing effectiveness | An evaluation after every incident and with every yearly audit. | Incidents |
| g) Basic hygiene | Least privilege, and multi-factor authentication on every account Brewless is managed with. | Access |
| h) Cryptography | TLS in transit, provider keys encrypted at rest, sign-in secrets kept only as a keyed hash, no passwords. | Encryption and secrets |
| i) Access control | Roles per organisation, a database per organisation, an audit trail that cannot be rewritten, an admin that only opens with a passkey. | Access |
| j) Multi-factor authentication | Passkeys for the console and the admin, and multi-factor authentication on every provider account. | Access |
Need this mapping as a document for your supplier file? Ask us at security@brewless.eu.
EU AI Act
The AI regulation (EU) 2024/1689 applies in stages. There is no AI Act certificate for ordinary business software, and we do not claim one.
In the product
Brewless has no AI functionality. Nothing you put into Brewless, and nothing in your accounts, is sent to an AI model.
In how it is built
AI coding tools are used in building Brewless. They see source code, never customer data, and every change passes the same checks before it ships.
If that changes
Should Brewless ever offer an AI feature, the interface will say so (Article 50) and this page will say which model runs where.
No models of our own
We train no foundation models and are not a provider of general-purpose AI.
When something goes wrong
A fixed procedure, which supports both GDPR Article 33 and the staged reporting of NIS2 Article 23.
-
Detect and contain
At onceErrors are mailed to us as they happen. The first step is to stop the damage: access is closed and keys are replaced where needed.
-
Tell you
Without delayIf your organisation is affected, its owners hear from us without undue delay, with what we know: what happened, which data, and what we did about it.
-
Early warning
Within 24 hoursFor customers under NIS2 we support their early warning to the CSIRT within 24 hours.
-
Report
Within 72 hoursA breach of personal data with a risk to the people concerned is reported to the Dutch Data Protection Authority within 72 hours.
-
Evaluate
AfterwardsEvery incident is written up: its cause, its impact, what was done and what changes because of it.
Processors
Each handles only what its task needs, and all are established in the European Union.
| Processor | Task | Where |
|---|---|---|
| Scaleway SAS | Hosting of Brewless and its database | France (Paris) |
| BunnyWay d.o.o. (bunny.net) | Content delivery and DNS for brewless.eu | Slovenia; EU points of presence |
| Lettermint | Delivery of our mail | European Union |
| Mollie B.V. | Payments, once you take a paid plan | The Netherlands |
Your own providers are not our sub-processors: you have your own agreements with them.
Report a vulnerability
Found a weakness in Brewless? Write to security@brewless.eu and tell us what you found and how to reproduce it. We read every report and answer it.
Please give us the chance to fix it before you publish, and do not look at or change data that is not yours.
security@brewless.eu For machines: /.well-known/security.txt
Questions about your personal data go to contact@coding.agency.