konnospage.tsx83 lines · main
| 1 | export const metadata = { title: 'trust' }; |
| 2 | |
| 3 | export default function TrustPage() { |
| 4 | return ( |
| 5 | <> |
| 6 | <h1 className="font-mono text-2xl text-[var(--color-text)]">trust</h1> |
| 7 | <p className="mt-2 font-mono text-xs text-[var(--color-text-subtle)]"> |
| 8 | last updated 2026-07-19 · beta · operated by flndrn Limited (Cyprus) |
| 9 | </p> |
| 10 | |
| 11 | <h2 className="mt-10 font-mono text-lg text-[var(--color-text)]">enterprise auth</h2> |
| 12 | <p> |
| 13 | Briven Auth is built for multi-app products that need day-to-day login <em>and</em> company |
| 14 | IT controls. Enterprise surfaces include: |
| 15 | </p> |
| 16 | <ul className="mt-2 list-disc pl-6"> |
| 17 | <li> |
| 18 | <strong>SAML 2.0 + OIDC SSO</strong> — employees sign in with the company identity |
| 19 | provider (Okta, Entra, Google Workspace, custom OIDC). |
| 20 | </li> |
| 21 | <li> |
| 22 | <strong>SCIM 2.0</strong> — HR/IT systems can auto-add and remove users (and map groups |
| 23 | into Briven orgs). |
| 24 | </li> |
| 25 | <li> |
| 26 | <strong>Compliance pack</strong> — DPA / BAA templates and retention notes available to |
| 27 | project owners via the dashboard API (sales kit). Final contracts are signed with flndrn |
| 28 | Limited; flags are recorded per project after signature. |
| 29 | </li> |
| 30 | <li> |
| 31 | <strong>Audit + retention</strong> — auth audit and app logs with configurable retention |
| 32 | windows. |
| 33 | </li> |
| 34 | </ul> |
| 35 | <p className="mt-2"> |
| 36 | Subprocessors list:{' '} |
| 37 | <a href="/subprocessors" className="text-[var(--color-text-link)]"> |
| 38 | /subprocessors |
| 39 | </a> |
| 40 | . Status:{' '} |
| 41 | <a href="/status" className="text-[var(--color-text-link)]"> |
| 42 | /status |
| 43 | </a> |
| 44 | . |
| 45 | </p> |
| 46 | |
| 47 | <h2 className="mt-10 font-mono text-lg text-[var(--color-text)]">where data lives</h2> |
| 48 | <p> |
| 49 | Production API runs in the EU (France host for api.briven.tech). Customer project data is |
| 50 | isolated per project in the data plane. Team and enterprise needs (dedicated capacity, |
| 51 | residency questions) are handled case-by-case — contact sales / legal. |
| 52 | </p> |
| 53 | |
| 54 | <h2 className="mt-10 font-mono text-lg text-[var(--color-text)]">encryption</h2> |
| 55 | <ul className="mt-2 list-disc pl-6"> |
| 56 | <li>TLS on every public endpoint.</li> |
| 57 | <li>Per-project env vars: AES-256-GCM at rest with a platform-held KEK.</li> |
| 58 | <li>Session cookies: HTTP-only, Secure in production.</li> |
| 59 | <li>API / SCIM / SDK keys: SHA-256 hashed; only short suffixes displayed.</li> |
| 60 | </ul> |
| 61 | |
| 62 | <h2 className="mt-10 font-mono text-lg text-[var(--color-text)]">access & audit</h2> |
| 63 | <p> |
| 64 | Platform mutations (deploy, member change, env edit, key revoke) are written to an |
| 65 | append-only audit log. Auth-tenant events live in the project's auth audit stream. |
| 66 | IPs are hashed before storage where privacy policy requires it. |
| 67 | </p> |
| 68 | |
| 69 | <h2 className="mt-10 font-mono text-lg text-[var(--color-text)]">incident disclosure</h2> |
| 70 | <p> |
| 71 | We aim to disclose incidents that affect customer data within 72 hours of detection to |
| 72 | affected accounts and publish a post-mortem here within 30 days when material. Report |
| 73 | security issues to <strong>security@flndrn.com</strong>. |
| 74 | </p> |
| 75 | |
| 76 | <h2 className="mt-10 font-mono text-lg text-[var(--color-text)]">legal contacts</h2> |
| 77 | <p> |
| 78 | Privacy & DPA: legal@flndrn.com · Operator: flndrn Limited, Limassol, Cyprus. Terms and |
| 79 | privacy live under this site's legal section. |
| 80 | </p> |
| 81 | </> |
| 82 | ); |
| 83 | } |