Security

Your data stays yours

Blings builds every personalized video on the viewer’s device, so your customer data never reaches our servers.

Private by design

Your CRM sends each viewer’s details straight to their device. Our servers only hold the template.

Talk to our team

Your CRM Customer data

User's device Video renders here

S Sofía Gold member
D Daniel Silver member
P Priya New member

S Hi Sofía Gold member

S Sofía’s video

Blings servers Never see personal data

Certifications and compliance

ISO/IEC 27001:2022

Our information security management system is certified by the Standards Institution of Israel and verified through annual surveillance audits.

SOC 2 Type II

An independent auditor tested our controls over time against the AICPA Trust Services Criteria and confirmed they operate as designed.

GDPR

Data minimization is built in. The personal data that drives personalization resolves on the viewer’s device, not on Blings servers.

CCPA

Your customers’ personal data never reaches Blings, so your campaigns add no new data-sharing relationship to disclose.

Your data never leaves your hands

Legacy personalized video ships customer records to a vendor’s render farm and stores the finished files. Blings runs on a Zero-Knowledge Architecture that removes that exposure at the source.

No PII in transit to Blings. Your data resolves on the viewer’s device at the Moment of Open.
No PII at rest on our servers. We never receive the names, balances, or histories that populate each video.
No rendered files to leak. Each Smart Video is generated on demand, and nothing personalized is stored.

What Blings does receive: anonymized engagement metrics, such as watch time, clicks, and scene views. The data that personalizes each video is excluded from analytics.

The model holds at scale. McDonald’s has sent nearly 100 million MP5 videos since 2021, and Bare Necessities runs its campaigns knowing user data is never exposed to a third party.

Read the developer docs on signed URL tokens

Healthcare landing page graphic of a hand holding a phone showing a loyalty rewards message.

A security program that runs every day

Our ISO 27001 information security management system is backed by written policies that leadership reviews and approves, regular internal audits, and annual external audits.

Incident response and breach notification
Secure development
User access rights management
Logging and monitoring
Supplier security, including annual SOC 2 report review for high-risk vendors
Disaster recovery and record retention

A hand holds a pink smartphone displaying a personalized video frame with a Redeem My Points button and a plus 2,500 Points reward callout.

Frequently asked questions

Is Blings ISO 27001 certified?

Yes. Blings holds ISO/IEC 27001:2022 certification (certificate no. 1125495) from the Standards Institution of Israel. The certificate is valid through March 31, 2028, and is maintained through annual surveillance audits.

Has Blings completed a SOC 2 audit?

Yes. Blings has completed a SOC 2 Type II audit conducted by an independent third party. Type II means the auditor tested how our controls performed over a period of time, not just how they were designed.

Does Blings store my customers’ personal data?

No. Blings generates each Smart Video on the viewer’s device at the Moment of Open, so the personal data used for personalization stays in your environment. Blings never receives or stores it.

Is Blings GDPR compliant?

Yes. Blings is designed around GDPR data minimization. Because personalization resolves on the viewer’s device, your campaigns do not send customer records to Blings for processing or storage.

Can Blings support our vendor security review?

Yes. Our team regularly supports enterprise security reviews and questionnaires. Contact us and we will connect you with our security lead.

How do I report a security issue?

Send any security issue or suspected vulnerability to reports@blings.io. Include a description of the issue, the affected URL or product area, and any steps to reproduce it so our team can investigate quickly.

ISO/IEC 27001 SOC 2 Type II GDPR CCPA

Everything your security team needs

Our certifications, policies, and audit reports, in one pack.

Request our security pack