Book a pilot

Platform

How it worksReview panelCode AssurancePlanning and contextEngines and integrations

Brunelly

GovernanceSecurityCase studyResourcesPilotsLog inBook a pilot

Security and trust

Built to be trustedwith the code that matters.

Brunelly is designed for organisations whose software handles money, personal data and regulated processes. Here is how we protect your code, your credentials and the record of every decision.

Controls

How we protect your code and your record.

  • Operated by Brunelly, in the UK

    Brunelly runs as a managed service that we operate in the United Kingdom. If your source code and execution must stay inside your own boundary, talk to us about private deployment.

  • A workspace for every run

    Each engineering run works in its own workspace with its own Docker daemon. Reviewers run as separate sessions that cannot see one another’s work.

  • Your models, your accounts

    Bring your own model keys, or run Claude through your own Azure AI Foundry, AWS Bedrock or Google Vertex AI account, so model consumption stays with you.

  • Encryption and keys per tenant

    Data is encrypted in transit and at rest under a key hierarchy rooted in HSM-backed keys, with keys per tenant. Credentials are redacted from logs.

  • Access by role

    Permissions are set per organisation and per project. Merge policies can require named reviewers and enforce separation of duties, so no one approves their own change.

  • Tamper-evident audit

    Governance decisions, approvals and exceptions are hash-chained per tenant, verified continuously and sealed with signed anchors. Exports verify offline.

  • Data subject rights

    Subject access exports and erasure are built in. Erasure destroys the subject’s key, so their audit records become unreadable while the chain around them still verifies.

  • Assurance on everything that merges

    On GitHub and Azure DevOps, your merge policies and Code Assurance apply to pull requests on the branches you protect, including changes Brunelly did not write.

Status

What is true today, stated plainly.

Built for organisations whose software handles money, personal data and regulated processes. Every line carries its real status.

Human approvalAgents propose. People approve the write actions and merges your policies name.Live
Independent reviewUp to ten reviewers on the models you choose, blind to one another.Live
Policy-gated mergePinned organisation rules, evaluated at the exact commit, enforced on GitHub and Azure DevOps.Live
Audit evidenceA hash-chained, sealed record of every decision, exportable and verifiable offline.Live
Your modelsClaude, Codex, Gemini and others, on your own accounts. No lock-in.Live
ArabicA full right-to-left interface in Arabic.Live
CertificationSOC 2 Type 1 audit underway. Controls designed against SOC 2 and ISO 27001; not yet certified.In progress

Standards

Built to recognised standards.

We design our controls against SOC 2 and ISO 27001 and follow established security engineering practice in how we build, deploy and operate Brunelly: least-privilege identities, secrets held in managed vaults, and changes made through reviewed pull requests and deployment pipelines.

Our SOC 2 Type 1 audit is in progress; we are not yet certified. If your procurement needs a security questionnaire or a deeper review, we are glad to work through it with you.

Responsible disclosure

Found something? Tell us first.

If you believe you have found a security issue in Brunelly, please tell us privately at hello@brunelly.com. We will acknowledge your report, keep you informed and credit you if you would like.

Contact security

Keep exploring

The rest of the platform.

Get started

Make software engineering repeatable.

Every engagement starts with a scoped pilot on one problem that matters, measured against how your team works today.

Book a pilot See how it works