Security
Secure by default.In your control.
How BrightSite protects your site, your team, and your data, layer by layer, in plain words.
Layer 1 · The network
Every request is checked before it reaches your site.
- SSL on every domain: certificates are issued and renewed for you.
- Firewall and DDoS protection: at the edge, with our own rules on top.
- No open doors: our servers accept no direct traffic from the internet. Everything arrives through a private tunnel.
- Media on a CDN: images and files are served from a global network.
Layer 2 · Your accounts
Only the right people get in, with only the access they need.
- Two-factor sign-in: with an authenticator app, plus backup codes.
- Roles: Admin, Member, and Viewer, or custom roles on Scale, with unlimited team members.
- Passwords hashed with bcrypt: and changing yours signs out every other session.
- API keys you control: each tied to one person, revocable any time, and stored only as a hash.
Layer 3 · Your data
Your content is backed up, your secrets are encrypted, and your card never touches us.
- Continuous backups: at most about five minutes of changes at risk, with about two weeks of restore points, encrypted and restore-tested.
- Encrypted secrets: webhook secrets and connected-account tokens are encrypted with AES-256.
- Payments through Stripe: we never see or store card numbers.
- Version history and export: restore any published version, or download your whole site.
Layer 4 · AI and agents
Lumi and connected agents follow the same rules your team does.
- Same permissions as the person: every Lumi and agent action is checked against that person's role.
- Approval for risky actions: promoting staging, changing domains, inviting people, and deleting content wait for your yes in Lumi.
- Drafts first: agent edits are saved as drafts until someone publishes.
- AI access by role: choose which roles can use AI at all.
Also
The details people ask about.
6of 6 checked
Questions about security, or found something we should fix? Get in touch.
›checking 6 details
Private recordings
replay.maskingSession replay blanks passwords, emails, phone numbers, and card fields, and masks other typed text by default.
Hashed visitor data
analytics.visitorsAnalytics counts visitors with a one-way hash, so stored numbers never hold an IP address.
Audited staff access
staff.accessAny time our staff access an account, it's logged with who and when.
Activity log
site.activitySee who published, updated, or created what on your site.
Hosted in the United States
hosting.regionOur application servers are in Virginia.
Signed webhooks
forms.webhooksForm webhooks can carry an HMAC signature so your server knows the request came from us.
Build with
peace of mind.
7 days free. No credit card.Start free trial →