Our approach
Moonbrush Inc. (“Moonbrush,” “we,” “us” or “our”) handles licensed information about U.S. adults and data our clients entrust to us. We protect it with a written information security program of administrative, technical and physical safeguards, and we describe that program only as far as we can support it with evidence.
Compliance and assurance
| Framework | Status |
|---|---|
| SOC 2 Type I | Report available to clients and prospective clients under NDA |
| SOC 2 Type II | Observation period underway. Report targeted for 2027 |
| NIST Cybersecurity Framework 2.0 | Controls mapped across all six functions |
| ISO/IEC 27001:2022 | Controls aligned, self-assessed. We are not ISO 27001 certified |
| HIPAA | We do not ingest protected health information. A HIPAA readiness assessment is in progress |
| CCPA and U.S. state privacy laws | Consumer rights program for access, deletion, correction and opt-out of sale and sharing. Global Privacy Control honored. See our Privacy Notice |
Data protection
- Encryption. Data is encrypted in transit and at rest: AES-256 at rest across our data platform and object storage, and TLS 1.2 or higher for connections in transit. Keys are managed and rotated.
- Hashed delivery. Identifiers in audience deliveries are hashed with SHA-256. In standard delivery, raw personal information does not leave our environment.
- U.S. hosting. Our data platform runs in U.S. cloud regions.
- Private networking. Storage and compute use private networking. Our databases have no public endpoints, and only authenticated services are allowed in.
Access control
- Single sign-on and multi-factor authentication on Google Workspace, Databricks, Amazon Web Services and GitHub.
- Least privilege. Access is role-based and limited to what each person’s work requires. We review access every quarter.
- Production access is limited to our technical leadership and engineering team, and is logged.
- People. Personnel with access to production or client data are background screened as permitted by law, and everyone who works with us is bound by confidentiality terms.
Client data isolation
- Client-gated instances. Each client’s data is kept in its own gated instance. One client’s data is never disclosed to another, and it never trains models shared with other clients.
- Record caps. Each client organization has a cap on the number of records it can process in each cycle.
- Retention. Client data is kept for the term of the client’s agreement plus 90 days, unless the client directs otherwise. We delete it on request and can provide a certificate of deletion.
Monitoring and vulnerability management
- Cloud audit logging and alerting across our environment.
- Continuous control monitoring through Vanta.
- Dependency scanning of our code.
- A formal penetration test as part of our SOC 2 Type II program, with findings tracked to closure.
Incident response
- We maintain a written incident response plan with defined severity levels.
- We commit to notify affected clients within 72 hours of confirming a security incident that affects their data.
- We have had no security incidents or breaches to date.
Resilience
Our data is backed up with managed backups. We rebuild our consumer graph every month, which also exercises our ability to restore the platform from source.
Vendors
We review vendors and sub-processors as part of our security program. Our Sub-processors page lists the providers that process data on our behalf.
Security documentation for clients
Clients and prospective clients can request, under NDA, our SOC 2 Type I report, a completed security questionnaire and our current sub-processor list. Ask your Moonbrush contact, or email security@moonbrush.com.
Report a vulnerability
If you believe you have found a security vulnerability in moonbrush.com or any Moonbrush system, email security@moonbrush.com. Please include enough detail for us to reproduce the issue.
While we investigate, please:
- do not access, change or delete data that does not belong to you;
- do not disrupt our services or degrade them for others; and
- give us a reasonable chance to fix the issue before you disclose it to anyone else.
Testing beyond what is needed to confirm an issue requires our prior written permission, as our Terms of Use explain. We appreciate reports made in good faith.
Contact us
Security: security@moonbrush.com
Privacy: privacy@moonbrush.com
Moonbrush Inc.
5830 E 2nd Street, Suite 7000
Casper, Wyoming 82609, USA