Brief.ai

Book a demo

→

Security is

the architecture.

Brief is built for claims data: tenant-scoped indexes, permissions checked before retrieval, and an audit trail for every answer.

Book a security review

Read the DPA

SOC 2 Type II · ISO 27001 · AES-256 at rest

The boundary

is the product.

Isolation is not a policy we promise. It is a path the system cannot take.

Every retrieval runs inside one tenant. No shared index. No cross-tenant fallback.

Separate indexes

Each tenant has its own vector index, keys, and retention policy.

Access before retrieval

Permissions resolve before a single token is generated. A missing grant returns nothing.

Access before retrieval

Permissions resolve before a single token is generated. A missing grant returns nothing.

Tenant-scoped encryption

AES-256 at rest. TLS 1.3 in transit. Keys are scoped to the tenant.

No shared training

Prompts, documents, and citations never train a shared model.

No shared training

Prompts, documents, and citations never train a shared model.

cross-tenant reads

SOC 2 Type II

ISO 27001

Access, audited.

Every retrieval, export, and permission change is recorded with the tenant, actor, time, and result.

Logs are immutable and exportable.

Event

Actor

Time

Result

Retrieval · Tenant 03

Maya Chen

14:32:08 UTC

Allowed

Cross-tenant probe

Unknown

14:31:44 UTC

Blocked

Source opened · §7.3

Maya Chen

14:32:12 UTC

Allowed

Export requested

Maya Chen

14:33:01 UTC

Queued

Retention 24 months · Export on request

Immutable log

Data stays where

you put it.

Residency, retention, and subprocessors are contract terms, not settings buried in an admin panel.

The DPA names every subprocessor and every region.

Data residency

US or EU, chosen at contract. No cross-region replication by default.

US / EU

Retention

Per-tenant retention windows. Delete a source and its vectors leave the index.

Tenant-set

Subprocessors

Named, reviewed, and listed in the DPA. No silent additions.

Listed

Read the DPA

Ask us

the hard questions.

Security reviews start with your architecture, not a slide deck. Bring your team.

Book a security review

Read the privacy policy

30-minute review · NDA available