Security and Compliance
How we protect your data. How we hold a high bar for security and compliance.
Bridgham protects its own data the same way it protects yours.
We sell cybersecurity, so our practices have to meet or beat the standards we ask of clients.
Compliance and Certifications
Current Compliance
PCI DSS
- SAQ-A compliant via Stripe
- Annual Self-Assessment Questionnaire submitted
- All payment data handled by PCI Level 1 certified provider
NIST Cybersecurity Framework 2.0
- Self-assessed implementation
- 6 core functions: Govern, Identify, Protect, Detect, Respond, Recover
- Documented control mapping available upon request
North Carolina Identity Theft Protection Act
- Compliant with reasonable security measures
- 45-day breach notification procedures in place
FTC Safeguards Rule
- Written Information Security Plan (WISP)
- Designated qualified individual responsible for security program
State Privacy Laws
- CCPA/CPRA (California) - Privacy Policy disclosures ready
- VCDPA, CPA, CTDPA, UCPA - Monitoring and ready to comply
- AI Transparency Laws - Aligned with Colorado AI Act, California SB 942, Utah AI Policy Act
Planned Certifications
- SOC 2 Type I - Independent audit of security controls (Q2 2027)
- SOC 2 Type II - Operational audit over 6-12 months (Q4 2027)
- ISO 27001 - International information security standard (2028+)
Infrastructure
Data Residency
- All data stored in United States data centers
- No international transfers
- GDPR-ready with Standard Contractual Clauses if needed
Backup and Disaster Recovery
- Daily backups retained for 30 days
- Point-in-time recovery for last 7 days
- AES-256 encryption for all backups
- RTO: < 4 hours / RPO: < 1 hour
Privacy and Data Protection
Data We Collect
- Account data: Name, email, company name
- Payment data: Billing address (cards handled by Stripe)
- Security assessment data: Compliance scores
- Usage data: IP address, browser type, pages visited
Data We Do Not Collect
- Social Security Numbers
- Government-issued IDs
- Biometric data
- Precise geolocation
- Health information
Data Retention
| Data Type | Retention | Reason |
|---|---|---|
| Account information | 7 years | Legal compliance |
| Payment records | 7 years | IRS, PCI DSS |
| Security assessments | 3 years | Compliance audits |
| Usage logs | 1 year | Security monitoring |
Data Sharing
We do not sell your data to third parties.
We only share data with:
- Service providers: Stripe, Supabase, SendGrid
- Legal compliance when required
- Business transfers (you will be notified)
Employee Access and Training
Access Controls
- Principle of least privilege
- Background checks for data access roles
- Multi-factor authentication required
- Immediate offboarding upon termination
Security Training
- Annual cybersecurity awareness training
- Monthly phishing simulation tests
- Data privacy training (CCPA, GDPR, NCITPA)
- Quarterly incident response drills
Transparency and Incident Response
If a security incident happens, we will:
- Notify affected customers within 45 days
- Disclose the nature of the incident
- Provide remediation steps
- Post public incident report if over 1,000 users affected
Historical incidents: None (as of January 2025)
Report a Vulnerability
Found a security vulnerability? Please report it to support@bridghamcyber.com
We commit to:
- Acknowledge your report within 48 hours
- Provide status updates every 7 days
- Fix critical vulnerabilities within 30 days
- Credit researchers with permission
Security Resources
Security is built into how we work, not bolted on after the fact.
We maintain strict security practices, stay open when incidents happen, and keep improving our security posture over time.
Questions? Contact us at support@bridghamcyber.com
Last updated: January 2025