Security should be part of the foundation.

No online service can promise that security risks will never arise.

Technology changes. Threats evolve. New vulnerabilities are discovered.

Our responsibility is to approach these challenges seriously, improve our systems and communicate accurately about the controls available.

We focus on three principles.

Protect access

Provide practical controls that help users secure their accounts and manage access.

Reduce unnecessary exposure

Design services with careful consideration for the information they process and the systems they depend on.

Be transparent

Explain implemented protections accurately, distinguish current capabilities from future plans and avoid unsupported security claims.

Multi-factor authentication

Passwords can be compromised through phishing, reuse or data breaches.

Brenwy Account supports multi-factor authentication, providing an additional layer of protection for supported sign-in flows.

Review the available authentication methods and configure the options supported by your account.

Account sessions

Knowing where your account is signed in is an important part of protecting access.

Brenwy Account provides session-management functionality so you can review and manage supported account sessions.

If you notice activity you don't recognise, review your sessions and account security settings promptly.

Organisation access

Business accounts involve additional responsibilities.

Brenwy Business provides organisational administration and supported controls for managing members and their access to business services.

Available security policies and permissions depend on the current business configuration.

Brenwy Mail

Email is frequently used to reset passwords and recover access to other online accounts.

Protecting your Brenwy Account is therefore an important part of protecting your inbox.

Brenwy Calendar

Calendars can contain personal schedules and business information.

We consider appropriate access control and account security important parts of the calendar experience.

Brenwy Business

Organisations need clear ways to manage membership, access and subscription seats.

Our business administration tools support these responsibilities through the Brenwy ecosystem.

Brenwy Search

Search involves different security and privacy considerations from account-based applications.

Our privacy notice explains search data handling separately from private account-based services.

Encryption claims need to describe the information and process involved. We do not claim that every part of the platform is end-to-end encrypted or protected in the same way.

Protected mailbox content

Mailbox keys are generated in your browser. Servers hold public keys and private-key packages encrypted for authorised devices, rather than the usable mailbox private key needed to independently decrypt the protected archive. Keys are not derived from your name, email address or account identifier.

Ordinary delivery and other records

Ordinary incoming email can be processed in readable form before storage encryption. Outgoing ordinary email uses a separate transport key controlled by the service so it can be decrypted for delivery. That key does not unlock the protected mailbox archive. External recipients and their providers may have access to their copies.

Calendar records, account details and some mail headers or delivery metadata are available to the server. Browser storage or device-key protection is not a blanket promise about all server processing. The privacy notice explains these distinctions and subject access rights.

Email support@team.brenwy.com with the subject “Brenwy security report” for a suspected vulnerability or account compromise. This dedicated subject distinguishes security reports from ordinary product enquiries.

Include the affected service, approximate time, a safe description and minimal reproduction steps. Do not include passwords, recovery codes, private keys, session tokens or other people’s personal information. Stop testing if it could expose data or disrupt a service.

Do not access other people’s accounts, bypass permissions, disrupt services or carry out destructive testing. This page does not grant testing authorisation or promise a bug bounty, response deadline or legal safe harbour.

Use a unique password and an authenticator

Enable the supported second factor and keep recovery codes somewhere secure outside your Brenwy account.

Review access and keep devices updated

Check sessions and business membership. Keep your browser and operating system updated, and treat unexpected sign-in prompts, links and attachments cautiously.

Plan recovery carefully

Protect your recovery email and authorised devices. Losing a device or encryption key can affect access to protected content. Do not assume a password reset or a support request can recover it.

Does Brenwy support multi-factor authentication?

Yes. The current Account interface supports authenticator-app codes and backup recovery codes. This is not a claim that passkeys, hardware-key sign-in or SMS codes are implemented.

Can I manage active sessions?

Yes. Account security lets you review sessions and sign out other sessions. Device trust, application sessions and already downloaded data have different limits.

Is every service end-to-end encrypted?

No. Protected mailbox storage, ordinary email transport, Calendar and account records have different data-handling arrangements. See the privacy notice for the details.

Can support remove every security risk?

No service can guarantee absolute security. Use the security-reporting route for suspected exposure and the dedicated recovery route for access problems.