Security and privacy
Your clients' work stays theirs.
Separate workspaces, private clients, team-only notes and deletion that really deletes. Here is what BravaSpace does, in plain words, and what it does not claim.
Free for 14 days. No credit card needed.
Who can see what
Pick who is looking.
These rules are enforced by the database itself, so a bug in a screen cannot turn them off.
One client's invited people, while their Portal active switch is on.
Workspaces are separate
Everything you create belongs to your workspace. Another agency cannot read it, by any screen or function.
Invites, not open doors
People join a client by a single-use link that expires in 14 days and can be tied to one email. Signing up alone gives access to nothing.
One switch to pause
Turn off Portal active and a client loses access immediately. Turn it on again and nothing is lost.
Keys kept on the server
Credentials for connected tools, such as SE Ranking, Stripe, ActiveCampaign and Google, are stored where no browser can read them.
Careful web reading
AI tools that read a client's site only fetch public pages. Internal addresses and unusual ports are refused.
Read-only when a trial ends
If a trial ends or a subscription lapses, the workspace becomes read-only. You can still look around, but changes are switched off.
Deleting a client
Gone means gone, after a day to change your mind.
Slide to see what happens in the 24 hours after you press Delete client.
Deleting an account
Erasure covers our records too.
- 1
The owner asks
Only the workspace owner can do it, from Account, by typing the workspace name. On a paid plan, cancel it in Manage billing first.
- 2
Everything goes together
Clients, files, invoices, sign-ins and the Stripe customer are deleted in one step.
- 3
Our records are erased
The platform account and timeline, support chats and referral codes are removed, and mentions elsewhere become [deleted].
There is no export and no restore for a deleted account. Download your files, invoices and reports first. Your sign-up contact in our own CRM (ActiveCampaign) is not removed automatically: email us to have it removed.
Questions
Security, answered.
The database enforces it. Every workspace is separate, and a client user can only read their own client, and only while that client's Portal active switch is on. This is row-level security in the database, not just hidden screens. Isolation between workspaces is covered by automated tests.
Yes. Each teammate has a role (Admin, Team member, Contractor, Finance or Custom) and a level for each area, such as clients, tasks, messages, library, Studio and AI, meetings, client billing and apps: off, view or edit. You can also limit someone to the clients they work on. Contractors see only their clients, and only the owner pays for the plan or deletes the workspace. See Team permissions.
No. Internal notes live in a table only your team can read, and internal-only tasks never reach a client.
They get an account with no role, which sees nothing. People only get into a client portal through an invite link, which works once, expires after 14 days and can be limited to one email address.
Delete client hides a client and permanently deletes everything about them after 24 hours, with an undo until then. The workspace owner can delete the whole account, which removes everything including sign-ins. There is no export or restore for that, so download what you need first.
Deleting a workspace erases the data that identifies it inside BravaSpace, including our own records: the platform account record and its timeline, support chats, referral codes and any mention in other records, which is replaced with [deleted]. The Stripe customer is deleted too. The sign-up contact in our own CRM (ActiveCampaign) is not removed automatically; email us and we remove it. Read the DPA for the legal terms.
Into server-side storage that no browser can read. They are never put in the website code.
To draft anything, the AI features send the relevant workspace data to an AI provider. For client files your internal work is left out. Nothing the AI writes is sent to a client for you, unless you turn review off on a scheduled report.
Only through a support session opened by the platform owner, which is recorded in the account timeline. Staff cannot read workspace data through ordinary platform access.
What we do not claim
- We do not list formal certifications such as SOC 2 or ISO 27001 on this page.
- There is no two-factor sign-in option listed here.
- This page is a plain-language summary, not a contract. The privacy policy, DPA and terms are what bind.
The legal pages
Read the details.
Try it with one client.
Add some work. Share a file. Ask for feedback. See what your client sees, with your name on it. Free for 14 days. No credit card needed.