Security Overview

Effective Date: 2026-07-04  ·  Available on request per Terms §3.3; version-controlled.

This overview describes current BriefBank controls. BriefBank is not SOC 2 certified; SOC 2 is a roadmap goal only.

Architecture and storage

Customer Content is stored at rest in Azure in the United States: Azure PostgreSQL holds control-plane and data-plane records, extracted document text, and pgvector embeddings derived from ingested content. BriefBank does not retain the original uploaded file bytes; documents are processed at ingestion and the extracted text is stored.

Core controls

• Encryption in transit and at rest.
• Tenant isolation through dual-database row-level security keyed on org_id.
• Managed-identity (AAD) authentication between services; fail-closed authorization.
• Secrets stored in Azure Key Vault.
• Audit logging and least-privilege access for personnel and systems.
• Email/password and Microsoft SSO authentication.
• Clickwrap acceptance with immutable assent logging.

AI and data commitments

BriefBank does not train or fine-tune models on Customer Content; paid-tier content is never used for training. Provider postures are described in the Privacy Policy §3 and the Subprocessor List. Perplexity web search is opt-in and off by default and sends only the model-formed query string, via Perplexity's Sonar API under its published Zero Data Retention Policy; pre-send PII redaction is planned but not yet built.

Logging and telemetry

Production query-text capture is disabled. Console logs may retain truncated query fragments of up to 100 characters. PostHog is allowlisted to numeric/ID analytics without content. The error monitor is configured with send_default_pii=false, but no message-body scrubber is currently in place, so Customer Content could appear in an exception trace.

Deletion, retention, and backups

Account, library, document, and chat deletion purges related database rows and embeddings across planes; no raw uploaded files are retained, so none need separate deletion. Deletion is idempotent and event-driven; there is no scheduled automatic retention-expiry job. Paid deletion requests complete within 30 days; Free-tier content is promptly deleted on account closure. Backups follow the ordinary backup cycle.

Data residency

Customer Content stored at rest remains in the United States. Some inference may use Global/multi-region model deployments, so prompts/responses may be processed outside the U.S. during inference.

Subprocessors and incidents

BriefBank uses subprocessors under applicable DPAs/terms and provides notice and objection rights under Terms §3.5. Security incidents are handled and notified under Terms §3.7.

Vulnerability reporting

Report suspected vulnerabilities to info@aibriefbank.com with the subject "Security Vulnerability." Do not access other tenants' data, disrupt the Service, or exfiltrate data.