We take security and compliance seriously.

Yes, Brij is Soc 2 Type I compliant. A type 1 audit report can be provided upon request. We are tracking to complete Type II by 2027.

Our full privacy policy, list of sub-processors, and cookie policy are available in the Brij Privacy Center at brij.ai/privacy-center.

Our SOC 2 Type I report, Data Processing Agreement, our documented internal data deletion process, and a security architecture overview (included in the SOC 2 report), are all available on request.

No. Brij acts as a service provider and processor, and under our DPA, customer data is processed solely to provide the Brij service. Brij does not sell personal information, does not share it for cross-context behavioral advertising, and does not receive or disclose it in exchange for monetary or other valuable consideration.

By default, Brij pages load only functional cookies, so there is nothing to gate. If you add your own GTM scripts to a Brij experience, we recommend running your own cookie banner so consent stays consistent with the rest of your stack. We also offer a built-in banner you can enable, and you can customize the consent language or add an explicit consent checkbox at signup.

What cookies does Brij set, and how long do they last? By default, only the first-party functional cookies the experience needs. A session identifier for actions within a session and approximate location (country or region) for localization and fraud prevention, both expiring at the end of the session, plus a device identifier to distinguish new from returning visitors, expiring after up to 400 days or when the visitor clears their cookies. Server-side records are retained only as long as necessary for legitimate business purposes.

It depends on how your brand configures the experience. Categories can include contact information (name, email, phone), experience data (form responses, registrations, warranty and rebate submissions, receipt uploads, survey responses), device metadata (scan timestamps, IP address, device and browser type), and purchase verification data such as receipts. You control the configuration and the data is exportable by your brand.

Ultimately, your brand. Brij gives you the tooling for a compliant setup: consent-gated sending per destination, compatibility with standard consent management platforms and Google Consent Mode, and hashed match data. Whether your cookie banner, privacy policy, and opt-out flow actually meet CCPA, CIPA, GDPR, or any other applicable requirement is a determination for you and your own legal counsel. Nothing on this page is legal advice.