What is Branded Mayhem Collective?

Branded Mayhem Collective LLC is the holding company behind two arms: 8gnc, a brand and website agency, and br8n, an AI consultancy. Products is its shared toolkit of Claude Code plugins. It serves founders and operators who want their digital presence to feel human, not generic.

8gnc or br8n — which one do I need?

Choose 8gnc (the agency) if you need brand strategy, a website, identity, or ongoing brand operations delivered for you. Choose br8n (the practice) if you want AI capability installed into your own team — owned and operated by you, not outsourced. Many operators use both; if you are not sure, start with a free Brand Therapy session or a diagnostic call.

What services does 8gnc offer?

8gnc is a brand and digital strategy agency offering six capabilities: brand strategy, identity and design, website design and development, content, activation and growth, and community. Every engagement runs in three phases — strategy first (Brand Therapy), then build, then ongoing Brand Ops. Strategy is never skipped.

What is Brand Therapy?

Brand Therapy is a free 30-minute diagnostic session with 8gnc. It surfaces what is working and what is broken across your brand, site, and positioning — without a pitch. It is the starting point for every 8gnc engagement and is available at 8gnc.io.

What does br8n do — AI capability installation?

br8n installs AI delivery capability inside companies. That means scoping which workflows AI can take over, selecting and configuring the right tools, training the team to operate them, and leaving the org owning its own AI capacity rather than outsourced to a vendor. It is consultant-installed, operator-owned.

Does the Collective work with small businesses or enterprise clients?

Both. 8gnc serves founder-direct SMBs — typically under a 90-day decision window — who want brand strategy and digital presence built right. br8n skews enterprise, working with organizations that are large enough to need AI capability installed across teams. A number of operators use both arms at different stages.

What are the Products?

Products is a set of consulting-grade Claude Code plugins — across brand strategy, product strategy, content, SEO/AEO, conversion, and sales — smuggled out of $50K engagements and packaged so you can install them once and own them forever. There is also a free, MIT-licensed Humanize Kit.

Where should I start?

Start with the diagnosis. Brand Therapy is a free 30-minute read on what is working and what is broken. If your question is about AI rather than brand, book a no-pitch diagnostic call. From there, the Collective points you to the right door.

Who is behind the Collective?

Branded Mayhem Collective is founder-led by Michael Sebastian, based in Richardson, Texas. Every engagement is senior-led — no junior handoff.

Trust Center

Request access

Branded Mayhem Collective

Branded Mayhem Collective is the Richardson, Texas holding company behind 8gnc, the agency, and br8n, the practice that installs AI-delivery capability inside client organizations.

We build and operate digital systems for other people’s businesses, so how we handle access, secrets and data is a fair thing to ask about before the first engagement.

What follows is what we actually run, verified rather than asserted — alongside a register of what we have not closed yet. The gaps are published on purpose. A wall of green checks with nothing behind it is easy to write and worth nothing to a reviewer.

michael@brandedmayhem.com

Compliance

BMC holds no certification in any framework below. Our 1 August 2026 SOC 2 self-assessment scored 48.7% readiness: 6 controls met, 25 partial and 7 missing across 38 controls. The audit has not been performed yet. Controls are being brought to evidence one at a time, after which a single unified audit will be performed by an independent firm — Schellman and A-LIGN are the two we are weighing. Until that firm issues a report, everything here describes our own work, not a third party’s attestation.

ISO/IEC 27001Information security managementReadiness

ISO/IEC 27017Cloud services securityReadiness

ISO/IEC 27018Personal data in the cloudReadiness

SOC 2Security, availability, confidentiality48.7% readiness

ISO/IEC 42001AI management systemsReadiness

NIST AI RMFAI risk managementReadiness

GDPREU data protectionReadiness

CCPACalifornia privacyReadiness

Resources

Data Processing AgreementRequired before client data reaches any system we operate.On request

Sub-processor and DPA registerEvery third party that touches client or operational data, with the status of each agreement.On request

AI tooling and client data policyWhich class of data may reach which AI tooling, and the DPA-backed route required before BMC operates client-data AI.On request

Privacy rights procedure and request channelAccess, deletion, correction and opt-out requests are accepted at hello@brandedmayhem.com and tracked through a documented procedure.Available

What we have not closed, with the plan for each. Published rather than gated.Published

Certification reportsNo independent firm has examined us, so no report exists to send. This page will say so until one does.Does not exist yet

Controls

Verified 1 August 2026

Full-disk encryption enforced on workstations
Host firewall enabled on workstations
TLS on all public surfaces, with HSTS and a hardened response-header set
Production database bound to loopback and the private network only, never a public interface

Multi-factor authentication required across the source-control organization
Secrets centralized in a managed secret store; no plaintext secrets in source
Security-awareness evidence includes 70 continuing-education credits across four dated credentials
Initial AI system register, risk assessment and impact assessment documented for BMC-operated AI use

Pull requests required across all active repositories, with deletion and non-fast-forward updates blocked
Application error monitoring with alerting

Sub-processor inventory maintained, each vendor agreement verified against its actual terms
Privacy rights requests accepted through a monitored channel with a documented handling procedure
Global Privacy Control is honored on this site for advertising-consent signals
Data residency documented per system and disclosed in the sub-processor table

Off-site backups on a scheduled cadence, encrypted in transit and verified present
Isolated application-data restore passed integrity, fidelity, 24-hour RPO and 48-hour RTO targets
Source control mirrored one-way to separate off-site storage, daily
Uptime monitoring with alerting on public surfaces

Open gaps

Published deliberately. Every entry names the gap, where it actually stands, and what happens next — no gap is listed without a plan.

No certification, and the audit has not been performed

Where it stands

BMC holds no ISO, SOC 2, or equivalent certification. Readiness work is underway and controls are being brought to evidence against the frameworks above, but no independent firm has examined us and no report exists.

What happens next

Controls are brought to evidence first, then a single unified audit by an independent firm covering the frameworks above rather than one engagement per standard. Certification marks and reports appear on this page when that firm issues them, and not a day earlier.

Application data is not encrypted at rest

Where it stands

The self-hosted database runs on a cloud server whose volume is not encrypted at rest. Our hosting provider’s data processing agreement puts at-rest encryption for cloud servers on us rather than on them, and we have not implemented it yet. Data is encrypted in transit, the host sits behind an authenticated tunnel with no database port exposed to the internet, and the provider holds ISO 27001 and BSI C5 Type 2 certification covering physical and operational security of the facility. None of that is the same as encryption at rest, so we list it here rather than let the workstation line imply it.

What happens next

Move the data volume onto an encrypted block device. This is a rebuild-and-restore rather than a toggle, so it is sequenced with the restore drill below — the drill proves the restore path the migration depends on.

Backups are not encrypted at rest

Where it stands

Off-site backups run on schedule to BMC-controlled storage and travel over an encrypted transport, but the archives themselves are not encrypted at rest and the destination volume is not an encrypted share. Physical control of that storage is the only thing standing behind it today.

What happens next

Encrypt the archives at creation so the protection travels with the file rather than depending on where it lands. Until that ships, this page will not use the word encrypted about backups at rest.

Restore testing has one successful point-in-time pass

Where it stands

A source-control restore drill passed on 26 July 2026. An isolated PostgreSQL and Convex application-data restore then passed integrity and fidelity checks and met the 24-hour recovery-point and 48-hour recovery-time targets on 27 July. Those are point-in-time results, not recurring Type II evidence.

What happens next

Both restore paths fold into a quarterly drill with dated results retained for the observation window. One successful exercise proves the path works; recurring evidence proves the control keeps working.

Core policies and the risk register await Owner adoption

Where it stands

The risk register now maps 28 risks to treatments and controls, and the core security policy set exists in draft. Neither has the signed Owner adoption evidence required to treat governance as an operating control.

What happens next

Review, approve and sign the policy set and risk register, then retain versioned adoption and annual-review evidence.

The incident-response program is not adopted or exercised

Where it stands

Monitoring and escalation paths exist, but the incident-response plan has not been formally adopted and no tabletop exercise has produced evidence that the team can execute it.

What happens next

Adopt the response plan, assign named roles, run a tabletop against a realistic scenario and record findings, owners and remediation dates.

Security monitoring and endpoint hardening are incomplete

Where it stands

BMC does not yet operate a complete vulnerability-scanning program, EDR or SIEM, scheduled log reviews, managed-device enforcement, or application allowlisting. Repository rules also do not yet require an approving review or passing status check before merge.

What happens next

Sequence the baseline as vulnerability scanning and required repository checks first, then managed-device, endpoint-detection and centralized review controls with retained operating evidence.

The access review is not fully attested

Where it stands

Access-control procedures and inventories exist, but the current review is not complete across every system and does not yet carry the Owner attestation needed for audit evidence.

What happens next

Complete the system-by-system access review, remove or justify exceptions, obtain Owner sign-off and repeat it on a fixed cadence.

One content platform routes to AI providers we do not control

Where it stands

Our content management platform names OpenAI, Google Cloud and Anthropic as its own sub-processors, and its agreement does not limit hosting to the European Union. Content placed in that platform can therefore reach AI providers through the vendor’s supply chain rather than ours. Our internal policy governs what we put into AI tools; it does not reach what a vendor does downstream, and we would rather say so than let the sub-processor list imply a tighter boundary than exists.

What happens next

Establish per-client whether that platform is the right home for their content, and disclose this chain in the engagement rather than at the point a questionnaire finds it. Where a client needs AI processing kept out of the content layer, the platform choice changes.

No DPA-backed BMC-operated client AI plane or active technical routing control

Where it stands

A fail-closed routing guard has been implemented and unit-tested in source, but it is not yet activated in BMC’s operating dispatcher. No BMC-operated client AI route is active today. Client data therefore has no permitted fallback to a personal subscription; client work remains in the client’s own licensed environment until the operating control and commercial evidence are complete.

What happens next

Activate the guard and a client route only after the commercial agreement, executed DPA, isolated Doppler project and client-specific processing decision are evidenced. Client-ZDR use remains inactive until a client requirement and compatible provider terms are in place.

No Content-Security-Policy

Where it stands

Public surfaces carry HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, but no CSP.

What happens next

Staged: report-only CSP first, tightened on collected violation evidence, then enforced. A rushed policy full of unsafe-inline would be worse than none.

HSTS preload staged, not complete

Where it stands

HSTS is live on all three domains with a one-year max-age and includeSubDomains. The preload token now serves on this domain; the other two carry it in configuration but have not shipped the deploy that puts it on the wire. No domain has been submitted to the browser preload list, and submission is not accepted until a domain is already serving the token.

What happens next

Submit this domain after a 30-day observation window, then the other two once their deploys land. Preload is difficult to reverse, which is the whole reason for the wait.