Security

Secure by default.In your control.

How BrightSite protects your site, your team, and your data, layer by layer, in plain words.

Layer 1 · The network

Every request is checked before it reaches your site.

  • SSL on every domain: certificates are issued and renewed for you.
  • Firewall and DDoS protection: at the edge, with our own rules on top.
  • No open doors: our servers accept no direct traffic from the internet. Everything arrives through a private tunnel.
  • Media on a CDN: images and files are served from a global network.
Layer 2 · Your accounts

Only the right people get in, with only the access they need.

  • Two-factor sign-in: with an authenticator app, plus backup codes.
  • Roles: Admin, Member, and Viewer, or custom roles on Grow and Scale, with unlimited team members.
  • Passwords hashed with bcrypt: and changing yours signs out every other session.
  • API keys you control: each tied to one person, revocable any time, and stored only as a hash.
Layer 3 · Your data

Your content is backed up, your secrets are encrypted, and your card never touches us.

  • Continuous backups: encrypted and restore-tested.
  • Encrypted secrets: webhook secrets and connected-account tokens are encrypted with AES-256.
  • Payments through Stripe: we never see or store card numbers.
  • Version history and export: restore any published version, or download your whole site.
Layer 4 · AI and agents

Lumi and connected agents follow the same rules your team does.

  • Same permissions as the person: every Lumi and agent action is checked against that person's role.
  • Approval for risky actions: promoting staging, changing domains, inviting people, and deleting content wait for your yes in Lumi.
  • Drafts first: agent edits are saved as drafts until someone publishes.
  • AI access by role: choose which roles can use AI at all.
Also

The details people ask about.

6of 6 checked

Questions about security, or found something we should fix? Get in touch.

security details
›checking 6 details
Private recordingsreplay.masking

Session replay always masks typed text, including passwords, emails, phone numbers, and card fields.

Hashed visitor dataanalytics.visitors

Analytics counts visitors with a one-way hash by default. Sites that turn on visitor identification keep IP addresses for a limited time, then delete them.

Audited staff accessstaff.access

Any time our staff access an account, it's logged with who and when.

Activity logsite.activity

See who published, updated, or created what on your site.

Hosted in the United Stateshosting.region

Our servers are in the United States.

Signed webhooksforms.webhooks

Form webhooks can carry an HMAC signature so your server knows the request came from us.

Build with
peace of mind.

7 days free. No credit card.Start free trial →