Executive Summary
AI-generated analysis for Brex
Brex (brex.com) is a financial software platform rated Tier 3 (Moderate Risk) by ThirdProof's rule engine, reflecting a broadly credible security posture with specific gaps requiring attention before full approval — most notably unverified certifications and unclear AI data handling practices. A significant strategic development is pending: Capital One announced a $5.15B acquisition of Brex in January 2026, which may have material implications for platform continuity, contractual terms, and data governance arrangements. Brex demonstrates several strong signals across independently sourced data:
Key Findings
- Domain established since 1998 (27+ years), with over 26 years of archived web presence
- Minimal infrastructure exposure: only 2 open ports (80 and 443), zero known CVEs — a significantly reduced footprint compared to the SaaS industry average of 8–12 open ports
- Clean threat intelligence: 0% abuse confidence score on its CDN IP, no malware or phishing flags from Malware detection service, and a zero threat score from website security scanning
- HTTP security grade of B (75/100) from independent header analysis, with 8 of 10 tests passing
- No adverse media signals in either recent or historical searches, and no sanctions or watchlist matches
- No SEC or FDIC enforcement findings — consistent with expectations for a fintech software vendor
- Vendor-attested claims of SOC 2 Type II, SOC 1 Type II, and PCI-DSS compliance on its public security page (https://brex.com/security), along with references to FINRA and NY Department of Financial Services requirements Two areas require follow-up before this assessment can be closed. First, none of the three claimed certifications (SOC 2 Type II, SOC 1 Type II, PCI-DSS) could be independently verified through a public registry — all remain vendor-attested. For a financial software vendor with high data access, obtaining the actual audit reports is a compliance necessity, not merely a best practice. Second, Brex's AI data usage policy does not clearly state whether customer data is used for model training, and no data retention period for AI processing is specified. Given that OpenAI is disclosed as a third-party AI provider, the absence of explicit training commitments and retention boundaries is a gap that warrants direct clarification. Additionally, the subprocessor page returned parsing artifacts rather than a structured list of named subprocessors, limiting supply chain visibility. Brex is conditionally recommended for continued or new vendor engagement. Procurement and security teams should obtain current SOC 2 Type II and SOC 1 Type II reports, clarify AI data handling commitments in writing, and monitor the Capital One acquisition for any changes to data processing agreements or subprocessor arrangements.
Independence Statement
All evidence in this report was independently sourced from external data providers, public registries, and open-source intelligence without vendor participation or notification.