Last updated: August 20, 2026
This Security Policy describes the technical and organizational measures BrainBox AI LLC (“BrainBox”) maintains to protect Customer Content. It is referenced by BrainBox’s Cloud Service Agreement and serves as Annex II (Technical and Organizational Security Measures) of BrainBox’s Data Processing Agreement.
BrainBox is designed to operate on metadata describing how a business is structured and interpreted — database schemas, connector configurations, policy and process documents, vocabulary, and the compiled Domain Model derived from them — rather than on raw transaction records or customer databases.
The intelligence-trace layer stores BrainBox’s interpretation of an event together with a pointer back to the system that owns the underlying artifact. BrainBox does not store the raw artifact itself.
Customers control what they submit. The Agreement restricts submission of Prohibited Data, including financial account numbers, government identification numbers, health information, and special categories of data under the GDPR.
The Service runs on Google Cloud Platform in the United States. Data at rest is stored in Firestore and Google Cloud Storage. Large language model inference is performed through Google Cloud (Vertex AI / Gemini) under terms that do not permit use of Customer Content to train Google’s models.
BrainBox does not operate its own data centers or physical infrastructure. Physical and environmental security is provided by Google Cloud Platform under its own certifications and controls.
Customer Content is encrypted in transit using TLS and encrypted at rest using the encryption provided by the underlying Google Cloud services.
Access to production systems is limited to personnel who require it to operate and support the Service. Authentication to production infrastructure uses Google Cloud identity and access management with multi-factor authentication. Service accounts are scoped to the access required for their function.
End-user authentication to the Service uses Firebase Authentication, with support for single sign-on where a customer enables it. Passwords are stored hashed; BrainBox does not store passwords in recoverable form.
Access to a customer’s projects is scoped by API key. A tenant key grants read access to the shared brains designated for that customer’s deployment and write access only to that tenant’s own brain. Scoping is enforced by the Service when a request is authorized, before any brain content is returned, and does not depend on instruction to the querying agent.
BrainBox maintains tests covering key scoping and runs them as part of its development process.
BrainBox maintains application and infrastructure logging through Google Cloud Logging, and observability of model interactions through Langfuse. Changes to a customer’s compiled Domain Model are recorded in an append-only history identifying the source of each change, available to the customer at any time.
BrainBox maintains an internal incident response process covering detection, triage, containment, remediation, and post-incident review.
Where BrainBox confirms a Security Incident affecting a customer’s Customer Content, BrainBox will notify that customer’s designated contact without undue delay and in any event within 72 hours of confirmation. The notification will describe what is known at the time — the nature of the incident, the categories of Customer Content or tenant scope affected, containment and remediation steps taken or planned, and a point of contact — and will be updated as more becomes known.
Changes to the Service are made through version control with change history. BrainBox uses managed platform services and keeps dependencies current as part of ordinary maintenance.
BrainBox’s current subprocessors are listed at brainbox-ai.app/dpa. BrainBox imposes data protection obligations on subprocessors that are materially consistent with its own obligations to customers.
Customer Content is retained for the duration of the customer’s subscription. On termination, BrainBox will delete Customer Content on request in accordance with the Agreement, except where retention is required by law or for ordinary backup and record-retention practices.
BrainBox relies on the durability and availability characteristics of the underlying Google Cloud services. BrainBox does not currently offer a contractual recovery time or recovery point objective.
BrainBox is an early-stage company and states its posture plainly rather than implying more than exists:
Customers with requirements in these areas should raise them before contracting so they can be discussed directly.
BrainBox may update this Policy as the Service develops. BrainBox will not make changes that materially reduce the protections described here during a customer’s subscription term without notice to that customer.
Questions about this Policy: legal@brainbox-ai.app