Branded Mayhem Collective

BMC holds no ISO, SOC 2, or equivalent certification. Readiness work is underway and controls are being brought to evidence against the frameworks above, but no independent firm has examined us and no report exists.

The permanent data and agent hosts each have encrypted off-site repositories with independent primary and break-glass credentials. Application data, volume state and encryption-header restores passed integrity checks on 3 August 2026, and both repository credentials were tested independently. Those are current point-in-time results; they are not yet retained operating evidence across an observation window.

The core policy set, risk register, AI management charter and privacy determinations were reviewed, signed and adopted by the Owner on 6 and 7 August 2026, with versioned adoption records on file. What does not exist yet is history: recurring reviews, measured indicators and cadence evidence all start from this month.

The incident-response policy was adopted on 6 August 2026 with monitoring and escalation paths in place. No tabletop exercise has yet produced evidence that the plan executes under pressure.

The production Linux hosts now have audit logging, intrusion blocking, mandatory access controls, automatic security updates, persistent journals and runtime health monitoring. BMC still does not operate a complete vulnerability-scanning program, EDR or SIEM, scheduled centralized log reviews, managed-device enforcement, or application allowlisting. Repository rules also do not yet require an approving review or passing status check before merge.

Access-control procedures and inventories exist, but the current review is not complete across every system and does not yet carry the Owner attestation needed for audit evidence.

Our content management platform names OpenAI, Google Cloud and Anthropic as its own sub-processors, and its agreement does not limit hosting to the European Union. Content placed in that platform can therefore reach AI providers through the vendor’s supply chain rather than ours. Our internal policy governs what we put into AI tools; it does not reach what a vendor does downstream, and we would rather say so than let the sub-processor list imply a tighter boundary than exists.

Sanity stores structured site content for one property and offers no self-serve data-processing agreement. Rather than leave that ambiguous, we audited the full dataset on 7 August 2026: no end-user records, lead records, form submissions, or account records exist there — the project is restricted to public-bound editorial and marketing content, whose only identified personal data is the operator’s own author byline. On that basis we adopted a signed current-use limitation determination: Sanity is prohibited from holding client personal data, end-user personal data, form data, or personnel data, and the audit re-runs on any schema change or annually. Sanity’s own attestation is SOC 2 Type 2; the ISO 27001 certification on its security page belongs to its infrastructure provider, and we will not repeat that claim on its behalf.

A fail-closed routing guard has been implemented and unit-tested in source, but it is not yet activated in BMC’s operating dispatcher. No BMC-operated client AI route is active today. Client data therefore has no permitted fallback to a personal subscription; client work remains in the client’s own licensed environment until the operating control and commercial evidence are complete.

Public surfaces carry HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, but no CSP.

HSTS is live on all three domains with a one-year max-age and includeSubDomains. The preload token now serves on this domain; the other two carry it in configuration but have not shipped the deploy that puts it on the wire. No domain has been submitted to the browser preload list, and submission is not accepted until a domain is already serving the token.