Security & Compliance

Last reviewed: 3 November 2026

Compliance statement

BrandBoss™ is a product of Bossit Limited, a New Zealand company. We aim to handle your information responsibly and in line with the New Zealand Privacy Act 2020. This page explains our current position honestly. BrandBoss does not currently hold any independent certification or audit report, and nothing on this page should be read as one.

Our data handling

• Each account can only see and change its own brands, billing details and plan.
• Clients and suppliers get access through email addresses the brand owner approves; owners can add a password for extra protection.
• Only signed-in account holders can upload, change or delete files.
• Pages are served over secure HTTPS connections.
• We don't sell your data or use it for advertising.

GDPR

BrandBoss is built for New Zealand customers and follows the NZ Privacy Act 2020. We have not been assessed against the EU or UK GDPR. If you're in Europe or the UK, you can still ask to see, correct, export or delete your information by emailing us.

PCI DSS (card payments)

Payments are processed by Stripe on Stripe's own secure checkout. Your full card number is entered with Stripe, not BrandBoss, and we don't store it. BrandBoss itself is not PCI-certified; card security is handled by Stripe.

SOC 2

BrandBoss does not hold a SOC 2 report. If your organisation needs one for supplier approval, get in touch and we'll tell you what we can provide.

Platform security evidence

Automatically generated technical evidence for this website is available in our Trust Center. See also our Privacy Policy and Terms.

Contact

Questions, privacy requests or a security concern? Email hello@brandboss.nz.