Security and data isolation at GoBrise

TENANT ISOLATION

Each business's data is separated from every other business

In place Every conversation, message and knowledge base entry belongs to exactly one company account. Access rules are enforced in the database itself rather than only in the application layer, so a request that is not tied to a signed-in member of a company is designed not to return that company's data.

• Row-level access rules scope every record to the company that owns it
• Dashboard queries run with the signed-in user's own permissions, not as a privileged shared account
• The public chat widget reaches data only through narrowly scoped server functions, and only for the one business its widget key belongs to
• Public widget endpoints are rate limited per session
• Conversation history is readable only by members of the business that received it
• Customer data is not shared between customer accounts and is not used to benefit another customer

Enforcing these rules at the database layer means isolation does not depend on every application code path being correct. It is the control we consider most important in a multi-tenant AI product, and the one we would point a reviewer to first.

What we do not claim. No system is completely secure. We do not represent that isolation cannot fail, that it has been verified by an independent party, or that it conforms to any certification or framework. See What is not in place below.

DATA HANDLING AND AI

AI replies are grounded in your own content

In place AI replies are switched off by default for every new workspace; you decide when to turn them on. When they are on, the AI agent answers from the knowledge base content your team has added to your own account. Retrieval is restricted to your knowledge base, and no shared or cross-customer content pool is used.

• Retrieval is scoped to your account's own knowledge base
• Visitor conversations stay scoped to the business the widget belongs to, visible only to that business's team
• The AI agent is designed to hand a conversation to a human when your material does not support a reliable answer, rather than guess
• A confidence score is recorded for every AI reply and is visible to your team in the dashboard

Two honest caveats. First, we do not review, verify, moderate or fact-check the content you add; answer quality depends directly on your knowledge base. Second, escalation depends on your configuration and your team's availability, and we do not guarantee that any individual conversation will be escalated or that a confidence score reflects actual accuracy. AI output may be incomplete, inaccurate or unsuitable, as set out in our Terms of Service.

Our public accuracy scorecard at gobrise.com/trust shows how the AI performs on a published test set. It is informational only, reflects specific test conditions, and does not predict results for your deployment.

AI PROVIDERS AND MODEL TRAINING

Your conversations are not used to train AI models

In place To generate a reply, the content of a message, relevant excerpts from your own knowledge base, the conversation context and your configuration are sent to third-party AI infrastructure providers engaged as sub-processors, solely to produce a response to that message.

We do not use your conversations, your visitors' messages or your knowledge base content to train, fine-tune or develop general-purpose or foundation AI models. We use AI providers and access routes whose published API terms state that submitted content is not used to train their models. This is a binding restriction in our Data Processing Terms, not a statement of intent.

What happens inside your own account. When your team chooses to save an answer from a resolved conversation to your knowledge base, it is indexed so your own AI agent answers that question better next time. This stays inside your account and never benefits another customer.

What we cannot control. Our AI providers are used on their standard API terms, under which they may retain submitted content for a limited period for abuse monitoring, security and legal compliance before deleting it. We do not control that period. We will confirm our current AI providers and their retention and training terms in writing on request.

We may analyse usage in aggregated or anonymised form, such as volumes, latency and error rates, to operate and improve the Service. That data does not identify you, your team or your visitors.

INFRASTRUCTURE AND ENCRYPTION

Where your data lives and how it is protected

In place

• The Service runs on managed cloud infrastructure with a PostgreSQL database, using the tenant isolation described above
• Data is encrypted in transit using TLS
• Data is encrypted at rest as provided by the managed cloud infrastructure
• User passwords are stored as one-way hashes by our authentication provider, never in recoverable form
• Third-party API keys used by the Service are stored server-side only and never exposed to browsers
• We do not operate our own data centres; physical security of hosting facilities is provided by our cloud infrastructure provider under its own controls

Data location. Customer data is currently hosted in the United States.

Data residency is not available today. We do not offer regional data residency and give no commitment that data will remain in any particular region. If your obligations require data to stay in a specific region, please raise it with us before you commit.

AUTHENTICATION AND AUTHORISATION

Who can get into your workspace

In place

• Sign-in is required for all access to the customer dashboard, by email and password or with Google
• Password reset works through a verified email link
• Team members are invited by email and assigned an Agent or Admin role
• Users cannot change their own role; role changes are enforced in the database
• Administrators can invite and remove team members and can modify and delete data in your workspace, so grant administrator rights deliberately
• Widget keys scope public widget traffic to a single business

Not available today: multi-factor authentication for dashboard users.

Planned: single sign-on and SAML.

HUMAN ACCESS TO CUSTOMER CONVERSATIONS

When a person at GoBrise can see your data, and why

We would rather state this plainly than leave you to ask. Authorised GoBrise personnel and contractors may access customer data, including conversation transcripts and knowledge base content, only where reasonably necessary for:

Safeguards.

• Access is limited to a small number of people whose role requires it, on a need-to-know basis
• Personnel and contractors are bound by written confidentiality obligations
• We use anonymised, aggregated or redacted data wherever that is sufficient
• Support access is, wherever practicable, undertaken at your request or with your knowledge

What we do not do. We do not read conversations for general product browsing, marketing, building data sets or competitive purposes. Content accessed for the purposes above is not used to train AI models.

Where our people are. GoBrise LLC is registered in the United States. Members of our team and contractors are located outside the United States, including in India, and may access data remotely for the purposes and under the safeguards above, subject to the transfer safeguards in our Data Processing Terms. Please factor this into any data-localisation assessment.

Planned: customer-visible audit logs and self-serve access reporting.

SECURITY TESTING AND DEVELOPMENT

How changes reach production

In place

• Changes to the Service are made by authorised personnel using version-controlled source code
• Database configuration and access-policy security scans are run and reviewed before changes are published
• Known vulnerabilities in third-party software dependencies are reviewed and patched
• Error monitoring and logging are used to detect faults

Not in place: an independent penetration test or external security assessment. We have not had one performed.

INCIDENT RESPONSE AND BREACH NOTIFICATION

What happens if something goes wrong

In place If we become aware of a personal data breach affecting customer data, we will:

• take reasonable steps to contain and remediate it;
• notify the affected customer without undue delay, and in any event within 72 hours of becoming aware of it where the GDPR or UK GDPR applies, or otherwise within the period required by applicable law;
• share the information available to us: the nature of the incident, the categories and approximate volume of data involved, the likely consequences, and the measures taken or proposed; and
• where we act as processor, support you in meeting your own notification obligations.

Notifications go to the administrator email addresses on your account, so please keep them current. A notification is not an admission of fault or liability.

Current practice Security incidents are triaged and handled directly by the GoBrise team.

Your side. Please tell us promptly at security@gobrise.com about any suspected unauthorised access to your account or credential compromise.

VULNERABILITY REPORTING

How to tell us about a problem

In place Suspected vulnerabilities can be reported to security@gobrise.com. Please give us a reasonable opportunity to fix an issue before any public disclosure.

Current practice Reports are triaged directly by the GoBrise team.

Not in place: a published vulnerability disclosure policy, bug bounty programme or researcher safe-harbour statement.

SUB-PROCESSORS

The third parties involved in running the Service

In place We use third-party providers to operate the Service. They process data only to provide their function, under terms imposing confidentiality and data protection obligations, and may not use the data for their own purposes.

We describe sub-processors by function because providers may change at this stage. Ask us at any time and we will confirm current names in writing. We notify customers in advance of sub-processor changes and give an opportunity to object, as set out in our Data Processing Terms.

DATA RETENTION AND DELETION

You decide how long your data is kept

In place

• You can delete conversations and knowledge base entries, and remove team members, from the dashboard at any time. Deletion is irreversible.
• For visitor conversation data, you decide how long data is kept, in line with your own privacy commitments
• A copy of your data can be requested at support@gobrise.com; please do this before closing your account
• After an account closes, a limited window allows export and recovery, after which data is deleted or irreversibly anonymised

The specific retention and deletion periods are set out in our Privacy Policy, which is the single controlling statement across all our documents. We deliberately do not restate the numbers here, so this page and our legal terms cannot drift apart.

Planned: self-serve data export and configurable automated retention. Until then, bulk deletion can be requested at privacy@gobrise.com.

DATA WE ASK YOU NOT TO SEND US

Prohibited and regulated data

The Service has not been designed or assessed for regulated or highly sensitive data. Please do not add to your knowledge base, or collect through your widget:

• Protected health information or any data subject to HIPAA
• Payment card numbers, security codes or other data subject to PCI DSS
• Government identification numbers, financial account credentials or passwords
• Special category or sensitive personal data as defined by applicable law
• Export-controlled data
• Any other data subject to sector-specific regulatory obligations

unless we have expressly agreed in writing to support it for you.

GoBrise is not HIPAA-compliant and does not enter into Business Associate Agreements. In healthcare, finance, legal, company-formation or other regulated sectors, the Service is intended for general customer support and information only. You remain responsible for your own regulatory compliance and for configuring escalation appropriately.

YOUR SECURITY RESPONSIBILITIES

What sits on your side of the line

Security in a multi-tenant platform is shared. You are responsible for:

• Keeping your credentials and widget keys confidential
• Managing team member roles, and removing access promptly when someone leaves or changes role
• Granting administrator rights deliberately
• The security of the website where you install the widget
• The security of any system where you keep data exported from GoBrise
• Configuring the AI agent and escalation so sensitive information is not exposed to your visitors
• Having a lawful basis, and giving the notices and consents required by law, for personal data collected through your widget
• Telling your visitors they are talking to an AI system where the law requires it
• Deciding how long visitor conversation data is kept
• Telling us promptly about any suspected compromise of your account

PRIVACY AND DATA PROTECTION

How this fits with our legal terms

For visitor conversations collected through your widget, you are the controller and we are the processor. For our own account, billing and support data, we are the controller. Where those documents and this page differ, those documents govern.

WHAT IS NOT IN PLACE

Stated plainly, so you never have to infer it

We would rather you learn this here than halfway through a procurement cycle.

No certifications or independent attestations. GoBrise does not currently hold SOC 2, ISO 27001, HIPAA attestation, PCI DSS certification, GDPR certification under Article 42, or any other security, privacy or compliance certification or third-party attestation. SOC 2 is on our roadmap and has not been obtained. We have no audit report to share.

No independent security assessment. No penetration test or external security assessment has been performed.

Not available today:

• Multi-factor authentication for dashboard users
• SSO and SAML (planned)
• Customer-visible audit logs (planned)
• Self-serve data export (planned)
• Configurable automated data retention (planned)
• Regional data residency (planned)

No availability commitments. No uptime commitment, service level agreement, recovery time objective or recovery point objective on any plan.

No formal programmes yet. No published vulnerability disclosure policy, bug bounty or researcher safe harbour. No EU or UK representative under Article 27 GDPR. No Data Protection Officer.

No absolute security. No method of transmission or storage is completely secure. We work to protect your data appropriately, but we cannot guarantee absolute security, and nothing on this page is a warranty or guarantee of any outcome.

Roadmap is not a commitment. Nothing on this page, in our marketing or in our documentation commits us to deliver any planned feature by any date. Please do not sign with us in reliance on an unreleased control.

ENTERPRISE AND COMPLIANCE REVIEWS

What we can give you, and how to ask

We handle these directly and in writing, not through a ticket queue.

Available on request:

• A signed Data Processing Agreement
• Standard Contractual Clauses and the UK International Data Transfer Addendum
• A named list of current sub-processors, including our hosting and AI providers
• Written answers to a vendor security questionnaire
• Confirmation of our AI providers' retention and training terms
• Written confirmation of deletion after an account closes
• Information to support your transfer impact assessment

Not available: a SOC 2 report, an ISO 27001 certificate, an independent audit report or penetration test results, for the reasons above.

CONTACT

GoBrise LLC, a Wyoming limited liability company, United States.

If your review needs something specific documented, ask before you commit. We would rather tell you what is not ready yet than have you discover it later. Write to security@gobrise.com or sales@gobrise.com and you will get a direct answer from someone who knows the system.

Related: Privacy Policy · Terms of Service · Data Processing Terms · AI accuracy scorecard (gobrise.com/trust)