Trust & Security
Security and data handling
Brainy is built to be trusted with your organisation's documents. Here's exactly how we isolate your data, authenticate your team, and handle the vendors we rely on.
Data handling & retention
Every table that stores customer data carries an organization_id column, and every query is scoped through WorkspaceContext before it touches the database. When you delete a document, a project, or an account, it's a hard delete with cascading foreign keys — not a soft-delete flag that leaves your data sitting in a hidden table.
Multi-tenant isolation
WorkspaceContext is populated once per request, from your JWT's claims, by WorkspaceContextFilter — never from a client-supplied parameter. Every service call is scoped to your organisation at the query layer, so isolation doesn't depend on remembering to add a filter in the UI.
Authentication
Sign-in runs through Keycloak, a self-hosted, open-source identity provider using the OIDC standard. Roles and permissions are managed via groups. No third-party identity vendor ever sees your team's credentials.
Encryption & transport
All traffic to Brainy is encrypted in transit over TLS. Uploaded documents are stored in Cloudflare R2, which encrypts data at rest at the storage layer.
Infrastructure & subprocessors
A short list of every third party that touches your data or your payments, and what each one is for.
| Provider | What they do |
|---|---|
| Hetzner | Compute and hosting |
| Cloudflare R2 | Object storage for uploaded documents |
| OpenAI | Powers the LLM, embeddings, and vision-based parsing fallback |
| Creem | Payment processing (Merchant of Record) — Brainy never sees your card details |