Where we actually stand.
The controls that exist today, the ones that do not, and what we are doing about the gap. Written to be checked, not admired.
Every row below was verified against the running system on 4 September 2026. If that date is old, treat the page as old.
In place today
- Two-factor authenticationPartial
TOTP, available on every account, from Settings. It applies to password sign-in; signing in with Microsoft, Google or Apple relies on that provider's own authentication instead, and we would rather say so than imply otherwise.
- Workspace audit logIn place
Sign-ins, storage changes, deletions, CRM pushes, role changes and API keys, with actor, IP address and timestamp. Readable by workspace owners and admins in Settings, and exportable as CSV.
- Inactivity sign-outIn place
An unattended session ends after 60 minutes, with a warning first. It never interrupts a live meeting.
- Single sign-onIn place
SAML and SCIM, plus Microsoft Teams SSO. Configured with us rather than self-serve.
- Data export and deletionIn place
Both self-service, from Settings. Export gives a structured file of your profile, every meeting with its transcript and summaries, and your tasks. Deletion erases the account and the stored media with it.
- Customer-managed storageIn place
Point recordings at your own S3, Azure, GCS, SFTP, OneDrive or Google Drive storage, so media goes between the recorder and your storage without resting on ours.
- Data residencyIn place
Application servers, database and stored media are in Frankfurt, Germany, inside the EEA. The transfers that leave it are named in the DPA rather than summarised.
- Encryption in transitIn place
TLS on every connection, including the meeting audio stream and the live suggestion channel.
- Credential handlingIn place
Passwords hashed with bcrypt and never recoverable by us. OAuth and CRM tokens encrypted at rest. Sign-in attempts throttled per account and per IP address.
- Tenant isolationIn place
Every query is scoped to the requesting workspace and re-checked on the server for each call, rather than trusted from the interface.
- Published data protection termsIn place
An Article 28 DPA, a specific sub-processor list with a notice period, and a cookie policy naming every item we keep in your browser. All public, so procurement can read them before anyone signs anything.
Documents
Security questionnaire, architecture call, or a question this page did not answer: security@brieflee.ai for security, privacy@brieflee.ai for data protection.