Braze

AD TECH & ANALYTICS

LAST UPDATED 4 AUG 2026

OF 100

PARANOIA SCORE

WHAT THE POLICIES SAY

Braze, Inc. (NASDAQ: BRZE, founded 2011 as Appboy) is a New York-based customer engagement platform that brands embed in their apps and websites to send push notifications, email, in-app messages, and SMS. Its SDK automatically collects device and session data, and customers can enable collection of advertising identifiers and GPS location; in January 2026 the platform enabled interactions with 8.0 billion monthly active users. For end-user data, Braze operates as a processor on behalf of its brand customers, and its Data Processing Addendum states that Braze shall not sell or share Personal Data. Data leaves the platform primarily at customers' direction: Braze Currents streams engagement events to analytics and CDP partners such as Segment, mParticle, Amplitude, and Mixpanel, and Audience Sync pushes first-party audiences to ad platforms including Meta, Google, TikTok, and The Trade Desk. Braze publishes its sub-processor list, holds SOC 2 Type 2 and ISO 27001 certifications, and reports no material cybersecurity incidents to date. A 2020 Norwegian Consumer Council study observed Braze receiving sensitive data (sexual preferences, drug use) from customer apps OkCupid and Grindr.

TIMELINE

NO ENTRIES ON FILE YET.

TOOLS WE RECOMMEND

PLUS

RECEIPTS

14 ON FILE

COLLECTION

When an app integrates the Braze SDK, Braze automatically collects device and session data - including country inferred from IP address geolocation, device model, carrier, resolution, and time zone - and customers can additionally enable collection of the device's last known GPS location, which requires the user's location permission.

braze.com ↗

[2026-03-25] · COLLECTION

Braze's platform operates at very large scale: per its FY2026 annual report, the platform enabled interactions with 8.0 billion monthly active users across customers' apps and websites in January 2026, meaning per-user engagement profiles are maintained for billions of end users.

sec.gov ↗

[2026-06-23] · COLLECTION

Braze's privacy policy distinguishes its roles: for end-user data flowing through customer apps it acts as a Data Processor on the customer's behalf, while it is the Data Controller for data about its own website visitors, dashboard users, and prospects, for whom it collects device data (IP address, device and application identifiers, location) and usage/log data.

braze.com ↗

[2026-03-25] · OWNERSHIP TRANSPARENCY

Braze, Inc. is a Delaware-incorporated, NASDAQ-listed public company (BRZE) headquartered in New York that files audited annual reports with the SEC; its dual-class share structure ended on January 30, 2026, when all Class B super-voting shares automatically converted to Class A, so executives and early investors no longer hold super-voting rights.

sec.gov ↗

[2026-06-23] · OWNERSHIP TRANSPARENCY

Braze's privacy policy discloses its corporate structure and data locations: Braze, Inc. is located in the United States with group companies operating in Brazil, Canada, France, Germany, Ireland, Romania, Spain, the UK, Australia, Indonesia, Japan, Singapore, South Korea, and the UAE, and Braze, Inc. states it complies with the EU-U.S., UK, and Swiss-U.S. Data Privacy Frameworks for transatlantic transfers.

braze.com ↗

SHARING

Braze's Audience Sync product enables customers to push their first-party customer data from Braze to major advertising platforms - Meta, Google, TikTok, Snapchat, Pinterest, LinkedIn, Criteo, and The Trade Desk - for ad targeting, via what Braze describes as automated, encrypted syncs.

braze.com ↗

SHARING

Braze Currents lets customers stream end-user engagement event data in real time out of Braze to third-party data partners, including customer data platforms (mParticle, Segment, Tealium, Treasure Data, RudderStack, Adobe, Amperity), behavioral analytics providers (Amplitude, Mixpanel, Heap), and cloud storage warehouses; the export is configured and directed by the customer.

braze.com ↗

[2025-08-28] · SHARING

Braze's Data Processing Addendum (rev. August 2025) states that the customer is the Controller and Braze the Processor, restricts Braze to processing personal data only on the customer's documented instructions for the business purpose, and commits that Braze shall not sell or share Personal Data.

cdn.sanity.io ↗

[2026-06-01] · SHARING

Braze publishes a named sub-processor list (rev. June 2026) covering third parties that process personal data on its behalf - including Amazon Web Services, Google, Rackspace (which hosts end-user profiles), Twilio/SendGrid, and AI vendors OpenAI and Anthropic - and states sub-processors are bound by written agreements with confidentiality and security commitments substantially the same as the DPA's.

cdn.sanity.io ↗

[2020-01-14] · TRACK RECORD

In the Norwegian Consumer Council's January 2020 'Out of Control' study, technical testing by Mnemonic observed Braze receiving highly personal data from the dating apps OkCupid (including question answers about sexuality, drug use, and political views, plus ethnicity and GPS coordinates) and Grindr; the report's legal analysis treats those apps, as controllers, as responsible for transmitting the data to Braze.

web.archive.org ↗

[2026-03-25] · TRACK RECORD

In its FY2026 10-K, Braze states its cloud platform has completed a SOC 2 Type 2 security audit, is ISO 27001 certified, and is designed to comply in all material respects with HIPAA standards; the same filing states that, while unauthorized persons have attempted access, Braze has not to date identified any cybersecurity incidents that materially affected the company.

sec.gov ↗

TRACKING TECH

The Braze SDK does not collect the iOS IDFA or Google Advertising ID by default; each must be manually integrated by the app developer (on iOS requiring the App Tracking Transparency framework), and Braze documents that the SDK does not store IP addresses locally.

braze.com ↗

TRACKING TECH

Braze's platform is built around granular per-user event tracking: its documentation states the platform tracks a wide array of event data from customer integrations, explicitly including retargeting among the intended use cases for that data.

braze.com ↗

[2026-06-23] · TRACKING TECH

On its own websites, Braze uses cookies and other tracking technologies, session replay recording of visitors, and provides visitor data to third parties for cross-context behavioral advertising - which its policy acknowledges constitutes the 'sale' or 'sharing' of Personal Information as defined under the CCPA, with opt-outs offered including Global Privacy Control.

braze.com ↗

LAST REVIEWED 2026-08-04 · METHODOLOGY v1.7