// Trust & Security Report
Brex LLC (subsidiary of Capital One, N.A.)
Intelligent Finance platform with AI-powered automation for corporate spend management, including AI agents for expense management, accounting automation, bill pay, cards, and treasury. Marketed as 'Intelligent Finance' with features like Brex Assistant, Audit Agent, and Review Agent.
Certifications held
5
Maturity
Enterprise
Trains on your data
No
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on brex.com“Brex is currently SOC 1 Type 2 and SOC 2 Type 2 compliant. System and Organization Controls 2 (SOC 2) is viewed as a robust audit of a business that outlines current approaches to security controls.”
Verify on trust-portal.brex.com“Brex maintains ISO/IEC 27001:2022 certification, with certifications available through Brex's Trust Center powered by SafeBase.”
Verify on brex.com“PCI-DSS Compliant. Additionally, Brex maintains PCI Attestation of Compliance documentation, with reports available through the Trust Center.”
Verify on brex.com“Brex acknowledges Data Protection Laws including the EU General Data Protection Regulation 2016/679. Each party will separately comply with its obligations under Data Protection Laws when processing personal data. For restricted transfers, the transfer shall be subject to the Standard Contractual Clauses, which are incorporated into and form an integral part of the DPA.”
> Show 3 unconfirmed / not-held certifications
source: brex.comNo public evidence of HIPAA BAA compliance or certification on Brex domain. Brex offers solutions for healthcare organizations but does not advertise HIPAA compliance as a core offering.
source: trust-portal.brex.comNo public evidence of FedRAMP certification or applicability documented on vendor domain.
source: trust-portal.brex.comNo public evidence of ISO/IEC 42001 or AI-specific governance certification documented on vendor domain.
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Offered
Data region
Global with Standard Contractual Clauses; data may be transferred globally as necessary to provide services in compliance with data protection laws. No specific geographic data residency requirement documented.
No public evidence that Brex trains AI models on customer data. Privacy policy does not mention model training. Data Processing Addendum explicitly restricts data use: 'Brex will...not retain, use, or disclose Personal Data for any purpose other than for the specific purposes of performing the Services and to comply with applicable law.' Customers can opt out of marketing communications and interest-based advertising.
// Security controls
// Products & data scope
data: Transaction data, spending patterns, employee spend across global markets
AI-powered controls and spend limits, available in 120+ countries
data: Receipt/invoice data, expense categorization, approval workflows, policy compliance
AI assistant automates expense categorization, policy enforcement, GL coding
data: Transaction data, accruals, GL coding, entity-level accounting information
AI-generated suggestions, 1000s of two-way ERP integrations, agent-based approval
data: Invoice data, vendor information, payment details, tax identification
AI-powered invoice entry, approval automation, per-transaction limits
data: Bank account data, treasury investments, cash management flows
Up to 3.67% yield with FDIC insurance protections, treasury management services
data: Travel itineraries, booking data, location information, travel expense policies
In-app booking, itinerary management, compliance tracking
// What to watch
- Product naming clarity: 'Brex AI' is not a distinct product name in Brex's marketing. The directory entry refers to Brex's Intelligent Finance platform with AI-powered features (expense automation, accounting agents, etc.), not a standalone 'Brex AI' tool. Clarify on listing that this is the Brex platform's AI capabilities, not a separate AI product.
- Fintech-focused: Brex is primarily a financial operations and spend management platform, not a pure AI tool. AI features are embedded within the platform (agents, automation) but Brex itself is a fintech solution.
- No HIPAA compliance documented: While Brex serves healthcare customers, there is no public evidence of HIPAA BAA or compliance certification.
- No AI-governance certs: No evidence of ISO/IEC 42001 or CSA STAR AI certifications, though Brex publishes guidance on AI risk considerations.
// At a glance
Pricing model
Freemium to tiered (plans start at $0/user/month, advanced features at $12/user/month)
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Brex LLC (subsidiary of Capital One, N.A.)'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-06. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
trust-portal.brex.com