SECURITY & TRUST

Your data. Your books. Your business. Protected.

Breva® is SOC 2 Type II certified, hosted on Microsoft Azure, and built from day one for the financial-data sensitivity of construction operations.

SOC 2 Type II

Microsoft Azure

SOC 2 Type II

Microsoft Azure

TLS 1.3 Encryption

MFA Required

What we do to keep your data safe.

What's included in your base

Audited annually by an independent third-party. Controls validated for security, availability, and confidentiality.

Encrypted everywhere

Data encrypted in transit (TLS 1.3) and at rest (AES-256). Credentials are to kenized and never stored on Breva servers.

Access controls

Mandatory multi-factor authentication on every account. Role-based permissions. SOC 2-aligne daudit logging.

Data sovereignty

Your data is your data. You can export, delete, or revoke partner access any time.

Need our SOC 2 report?

We share our SOC 2 Type II report with current customers and approved partners under NDA. Request access and our team will reach out within one business day.

Got It

Our security team will be in touch within one business day.

Oops! Something went wrong while submitting the form.

Got a security question? Email security@breva.ai

Security & Trust

Your books. Your data. Your control.

Breva's security controls have been independently examined under SOC 2 Type II. The platform runs on Google Cloud Platform, and bank connections are tokenized through Stripe Financial Connections — your banking credentials never touch Breva's systems.

Contact Security

Book a Security Review

SOC 2 Type II

TLS 1.3 Encryption

MFA Required

Safety Measures

How we protect your business.

Independently audited

SOC 2 Type II audit performed annually by a third-party firm. Controls are tested over time, not just at a point in time.

Encrypted everywhere

TLS 1.3 protects data in transit. AES-256 encryption protects data at rest in Google Cloud Platform.

Tokenized credentials

Bank and partner credentials are tokenized whenever possible and never stored on Breva servers.

Mandatory access controls

Multi-factor authentication, role-based permissions, and SOC 2-aligned audit logging on every sensitive action.

Data sovereignty

Export your data, delete your account, and revoke partner access at any time. You own your books.