Privacy
Privacy as infrastructure, not a promise in a footer.
Masked before any model. Nothing kept on the route. Never used for training. Each commitment, and where it stops.
Commitments
Seven things the design holds us to.
- 01
Masked before any model
The masking service replaces the details it detects with tags before a prompt reaches a model provider. For a masked-only tenant, the router refuses any request without a signed claim that this exact request was masked.
- 02
No content kept on the route
The router holds a request only in memory, for as long as the call lasts. No request or response body is persisted, logged or written to a record.
What it does keep: decision metadata (provider, region, cost, why) for 395 days by default, so you can audit where each request went.
- 03
Never used for training
We do not use your content to train or fine-tune any model, ours or anyone else's, and we do not sell it. We use model providers only on terms that exclude training on what we send.
- 04
Kept in your scope
Memory lives in Spaces. A search ranks only what the caller may read, and no cache is shared between tenants.
- 05
Traceable to its origin
Every record keeps its source. Every routing decision is recorded without its content. Every signature the authority makes is audited.
- 06
Yours to remove
Erasure is designed by tenant and by Space, and complete erasure across the pipeline is a launch requirement.
- 07
Where it may go, you decide
A policy can hold requests to the EU and EEA, Switzerland, the UK or the US, checked on every attempt, failover included.
Today: the available model endpoints are in the US; EU endpoints are planned.
Your data
What the pipeline is designed to hold.
For each product built on it. Each product's privacy notice sets out every retention period before launch.
| Data | Where it lives | How long |
|---|---|---|
| Your account | Sign-in and session records in memory's identity layer | While your account exists |
| What you add | Your Space, masked; the clear values encrypted in the masking service | Until you delete it |
| Your conversations | Your Space | Until you delete them |
| Routing records | Brain Ways, metadata only, never content | 395 days by default |
| What a model provider receives | The provider, as masked text | Under its terms, listed before launch |
Model providers
The model sees tags. What it keeps depends on its terms.
A provider receives masked text only. Some providers keep requests for a limited period to check for abuse.
Before launch we will publish each provider we use, its region and what it retains, and route only on terms that exclude training.
Limits
What we do, and what we do not claim.
What we do
- Mask personal details before any model sees them.
- Keep no content on the route, and record every decision.
- Keep your content out of any model's training.
- Publish our providers and sub-processors before launch.
What we do not claim
- Anonymisation: masked data is still personal data.
- Perfect detection: masking can miss a detail.
- Certification: we hold no SOC 2, ISO/IEC 27001 or ISO/IEC 42001 certificate yet.
- Compliance by label: we design to support it; it is shown in operation.
- Zero retention at providers: not in force yet.
This website
No cookies. No analytics. No requests to anyone else.
Everything is served from this site. No forms, no cookies. Only the theme and language you choose are stored.
Cookies and storage Privacy policy