BrambleHelp
ConceptDevelopers

Security

How Bramble Cloud protects sign-in, data and the API.

Updated 14 November 20262 min read

#Sign-in

  • Passwords are stored with scrypt. Two-step sign-in uses authenticator codes, and organisations can require it for everyone.
  • Repeated wrong passwords or codes pause sign-in for that account (see Authentication).
  • Sessions use short-lived signed tokens renewed from a server-side session, so ending a session or turning an account off takes effect straight away. Session IDs and API keys are stored hashed.
  • Organisations set session length and conditional-access rules (block or require two-step sign-in by location), and see every sign-in.

#Organisations are kept apart

  • Every organisation has its own address; a session from one organisation isn't accepted on another's address.
  • Every API checks that each record belongs to your organisation before returning or changing it. Records in another organisation look exactly like records that don't exist (404).
  • Partner (MSP) access to a customer needs the customer's explicit approval, works from a signed-in browser only, and is recorded on both sides.

#Tokens and keys

  • API keys act as their owner, expire after 30 days, can be revoked at any time, and stop working when their owner's account is turned off.
  • Tokens issued to other applications through "Sign in with Bramble" only identify the person to that application; they can't be used to call Bramble's APIs.
  • Browsers only let Bramble's own pages make signed-in requests to Bramble.

#Data

  • File contents are stored encrypted (AES-256-GCM) with a key per organisation.
  • Secrets that apps hold for you (connection passwords, vault entries, two-step secrets, mail server passwords) are encrypted at rest.
  • Uploaded files are served so they can't run code in the browser: active content (HTML, SVG and the like) opens in a sandbox or downloads instead.
  • Automations (Flows) can't reach private or internal networks.

#Transport

  • HTTPS only, with HSTS. Pages can't be framed by other websites.
  • RMM agents prove their identity with a per-device certificate on every session.

#Accountability

  • Admin changes, sign-ins, partner actions, remote sessions, backup restores and downloads are recorded in the audit log.

#Reporting a problem

If you think you've found a security problem, email Bramble IT support rather than raising it publicly. Include what you did and what you saw.