--- title: "Security at Briks: how your sites and data are protected" url: https://briks.dev/security description: "How Briks protects your sites, records and keys: where data lives, undo and restore, checks before every publish, and roles." last_updated: 2026-10-22 --- # Security at Briks How Briks protects your sites, your records and your keys, and what stays in your hands. Each point below is how Briks works today, with the plans it applies to beside it. **Your records** Each site's database and file storage are made in the European Union by default. **Every change** Saved as a version you can undo, redo or restore. **Your keys** Saved only to your published site. The studio keeps their names, never their values. **Before publishing** A change that loads scripts from a website you have not allowed, or holds a key, is stopped. Your live site stays as it was. **Payments** Paid straight into your own account, with no Briks fee. **Found a problem?** Write to [hello@briks.dev](mailto:hello@briks.dev). ## Where your data lives On every plan **Your site's records** A site that stores data gets its own database, made in the European Union by default. The place is set when the database is made. **Your site's files** Each site's own file storage is made in the European Union too, the first time it is used. **Nightly copies** On paid plans, the nightly copies of a site's database are kept in the European Union. **Everything else** Your account, your conversations and the rest of the studio's data are handled by the kinds of provider the [Privacy Policy](https://briks.dev/privacy#transfers) lists. Some of them process data outside the European Economic Area, under an adequacy decision or the European Commission's Standard Contractual Clauses. **Each site on its own** Every published site runs on its own, with its own server code, its own database for the records it keeps, and its own storage. A site's keys are bound to that site alone. **Sealed builds** The code for your site is built in a sealed space that cannot see any other site. ## Versions, undo and restore points On every plan Nightly copies on paid plans **Versions** Every build, change and recheck is saved as a version. Owners, Admins and Editors can undo, redo or restore one, and the site is published again as it was. **Your database's history** Owners and Admins can take a site's database back to an earlier moment in its history, or to a restore point. Briks takes a restore point itself before it changes how the database is laid out. **Nightly copies** On a paid plan, switch on a nightly copy of a site's database, each kept for 30 days. Anyone who can see the project can download one. **Code and records apart** Restoring a version of the code never changes the database, and restoring the database never changes the code. - [Versions, undo and redo](https://briks.dev/docs/versions) - [Backups](https://briks.dev/docs/backups) ## Keys and secrets On every plan **Secrets** Keys your site needs go straight to your published site, encrypted, where only its server code can read them. Briks keeps each key's name, who saved it and when. No one can read a value back, you included. **Keys in messages** A key pasted into a message by mistake is cut out before the message is kept or read by AI, when Briks knows its kind, and the reply says where it belongs. **Never in the code** A key written into any file of your site stops the publish, and so does code in the visitor's browser that reads a secret key. The code you download never holds your keys. **Briks's own keys** Your site's code can never read the keys Briks itself runs on. A change that tries is not published. - [Secrets](https://briks.dev/docs/secrets) ## Checks before every publish On every plan **What stops a publish** A change is held back, and your live site stays as it was, when it would load a script from another website, send what visitors do to another website, show another website's page inside yours, post a form to one, or send a payment key or money to an address you did not set up. You can allow up to 10 websites you trust in your project's settings. **What no one can allow** A key written into a file, a secret key read in the visitor's browser, and code that reads Briks's own keys are refused, whoever asks. **Every way in** The same rules apply to code you edit by hand and to code pushed from GitHub. **A security read** Before a build or change is published, Briks reads the code written for it for the mistakes that most often leak data: keys in files, routes that change data with no limit, members' records read without checking who is asking, database queries built from text, and payments trusted without proof. What it finds goes back to be fixed. **A launch check** Moving a site to production runs a launch check first. Placeholder text, pages without a title, links that lead nowhere, and a dashboard with no way to sign in each hold it back until they are fixed. - [Publish to production](https://briks.dev/docs/publish-to-production) ## The Security agent From the Starter plan **What it checks** Hire it for a project and it checks your code after every publish and the whole site every Monday: keys, the live site's security settings and certificate, files that should not be public, and the packages your site uses. **It asks first** It explains each finding in plain words, and every fix waits for an Owner or Admin to approve it. It never sees the value of a key. **Who hires it** Owners and Admins. It counts as one of your plan's agents for that project. - [The Security agent](https://briks.dev/features/security-agent) - [How to hire it](https://briks.dev/docs/security-agent) ## Payments on your sites Every plan, Free included **Your own account** Connect your own Stripe, PayPal, Mollie, Razorpay, Paddle, Lemon Squeezy, Polar, Creem or Dodo Payments account. Buyers pay you directly, and Briks takes no fee on your sales. **Your keys** Only Owners and Admins save payment keys. Each is tried before it is saved, then kept with your published site like any other secret. **Proof of payment** Every report of a payment is verified as coming from the payment provider before an order counts as paid. - [Sign-in and payments](https://briks.dev/docs/sign-in-and-payments) ## Sign-in for your visitors On every plan **Email and password** A site with accounts asks each new member to confirm their email before they sign in, keeps passwords only in a one-way form, and sends a reset link that works for an hour. **Sign in with** Owners and Admins can add Google, Apple, Microsoft, GitHub, X, Facebook, LinkedIn or Discord, with their own keys. **Limits** Sign-in and sign-up attempts are limited, so passwords cannot be guessed at speed. ## Your Briks account On every plan **A confirmed email** Every Briks account confirms its email before it is used, and passwords are kept only in a one-way form. **Your devices** Your profile lists every device signed in to your account, and you can sign any of them out. **Password reset** A reset link works once and for an hour, and resetting signs out every device. - [Your profile and sign-in](https://briks.dev/docs/account) ## Roles and invitations Teams from Pro **Four roles** Viewers see projects, previews and analytics and change nothing. Editors create, change and publish. Admins also manage members and settings. Only Owners handle billing, other Owners and deleting the workspace. **Invitations** An invitation works for 7 days, and only for the address it was sent to. - [Members and roles](https://briks.dev/docs/members-and-roles) ## AI agents and what they read From the Starter plan **It asks you** An agent asks before anything goes out, such as an email, a post or a change to your site, unless you let a kind of task go ahead on its own. Some kinds always ask. **Outside words** Words that come from outside, such as a form entry, a review or another website's page, are marked as not to be trusted, so an agent reads them as information and not as instructions. **Held for you** After an agent reads outside words, it may act alone only on a few narrow replies. An action carrying an address or link that did not come from the record or from you is held, and you are told. **Nothing slips out** What an agent sends is checked for keys and internal details first. **Its own workspace** Each agent sees only its own workspace, enforced in the database itself. - [Approvals and budgets](https://briks.dev/docs/agent-approvals) ## Your visitors' privacy On every plan **No cookies to count** Your site's analytics sets no cookies and stores no address. A visitor is counted by a code that changes every day, and browsers that ask not to be tracked are not counted. **A/B tests** An A/B test keeps each visitor in their version with a cookie. **Processing terms** For your visitors' data you are the controller, and Briks processes it for you under the data processing terms in the [Terms of Service](https://briks.dev/terms#processing). Briks tells you before it adds or replaces a provider, so you can object. ## Taking your work, and deleting it On every plan Downloads on paid plans **Take your work** On a paid plan, download the code written for your site at any time, and your records as JSON or CSV. **Delete your account** Delete it from your profile, confirming with your password, and it is deleted at once. If you are the only Owner of a workspace that has other people or projects in it, make someone else an Owner first. **Delete a workspace** An Owner can delete a workspace once it holds no projects and is not their only one. ## The company **Who we are** Briks is a trading name of SEMICOLON WEB TECHNOLOGIES. **Law** Its terms are governed by the law of Ireland. **The documents** The [Terms of Service](https://briks.dev/terms), the [Privacy Policy](https://briks.dev/privacy) and the [Refund Policy](https://briks.dev/refund-policy) set out how Briks works with you. ## Report a security problem ### Found a security problem? Write to [hello@briks.dev](mailto:hello@briks.dev) with what you found, where, and the steps that show it. Give Briks time to fix it before you share it, and never open or change data that is not yours while you look.