Enterprise Security.
Compliance-Ready.
No Drama.
Security teams don’t have time to babysit yet another tool. Broadcast is designed to fit inside enterprise security standards: integrations into leading SSO providers, SOC 2/Type 2 certified, a Google Cloud Partner, AES-256 bit encryption and VPAT-compliance.
Why Security Teams Love Broadcast
In addition to compliance, we've highlighted just some of the security measures used throughout Broadcast. From data security to application security, it's easy to see why some of the biggest companies in the world trust their communication to Broadcast.
Compliance
Built for Your Peace of Mind
GDPR
Broadcast supports GDPR-aligned data protection practices through strong security controls, access governance, and data handling procedures.
CCPA / CPRA
Broadcast supports customer obligations under CCPA and CPRA by enabling visibility, control, and secure handling of personal information.
VPAT and Accessibility
VPAT documentation is available upon request, and accessibility considerations are incorporated into product design and testing workflows, with ongoing efforts to align with applicable WCAG accessibility standards.
Data Security
Encrypted in Transit
All data in transit is protected using modern TLS (1.2+). That means traffic between users, systems, and Broadcast is encrypted end-to-end to reduce interception risk.
Data Security
Encrypted at Rest
Stored data is encrypted at rest using AES-256. Sensitive values can receive additional encryption protection using separate keys (out-of-band keying model).
Data Security
Backup and Restore
Production data is continuously backed up to encrypted storage and supports restoration to specific points in time along a stream of database changes.
Application Security
Single-Sign-On (SSO)
Broadcast supports all major SSO providers. Authentication is delegated to the customer’s identity provider, allowing existing security controls to remain authoritative. Supports SAML-based SSO with common identity providers (e.g. Okta, Azure AD, Google Workspace)
Application Security
Peer Review + Automated Security Scanning
Production code changes require peer review and must pass automated testing, including OWASP Top 10 scanning, vulnerability scanning, and dependency scanning.
Application Security
Role-Based Access Controls + Reviewable Changes
Access to production systems and internal tooling is determined by role and responsibility. Access is logged, audited, and changes require review before implementation.
Device Security
Strong Security Controls
Work devices are centrally managed, fully encrypted, protected with endpoint security controls, and required to stay up-to-date. Access to internal tools is protected with SSO and MFA.
Our security review was straightforward thanks to Cerkl's SOC2/Type 2 attestation: encryption, access controls, and operational practices were clear, and the implementation didn’t require heroics from IT or Security.
- Tom D., Vendor Security, Fortune 200 Technology Services Firm
