We built Briefi for ourselves first. That means encryption is per-tenant, OAuth is minimum-scope, and data is exportable on a single click. Below is exactly how that works in practice.
Sensitive content (briefs, follow-ups, AI replies, OAuth tokens, API keys) is encrypted with AES-256-GCM. Each workspace has its own data encryption key, wrapped by a global key-encryption key. We can't read your meeting briefs even if we wanted to.
Every database row is gated by Postgres row-level security. The query engine itself enforces tenant isolation — application bugs cannot leak across workspaces because the database refuses to return rows from tenants the caller isn't a member of.
Calendar and Gmail integration uses Google's standard OAuth grant. We request the minimum scopes necessary — read events, read mail, send mail. You can revoke access from your Google account at any time and Briefi loses access cleanly.
Workspaces are not a flat trust zone. Meetings can be workspace-visible, team-only, or private to their owner — sensitive types like 1:1s and interviews default to private. Personal mailboxes are private unless deliberately shared. A read-only viewer role and instant IdP deprovisioning are enforced by the database, and sensitive access is written to an auditable trail.
Settings → Data & Export gives you a single-click bundle: every meeting, contact, deal, and thread as JSON + CSV. We do not lock content. If you cancel, your data leaves with you and we delete the workspace 30 days after you confirm.
Calendar events arrive over OAuth from Google. We see start time, attendees, location, title. We do not see anything outside the events you've granted access to.
Anthropic Claude reads the event + your prior meeting history + the chosen discovery guide. The brief is generated in-flight and we encrypt it with your tenant's data encryption key before writing to Postgres.
The brief is decrypted when your browser fetches it via /api/meetings/get. The key never leaves the server. Database backups are encrypted at rest at the storage layer too — defence in depth.
Every third-party service Briefi uses to operate. We will email the workspace owner at least 30 days before adding any new subprocessor with access to customer data.
We don't have a bug bounty programme yet but we read every security report personally and respond inside 24 hours. Responsible disclosure rewards published once we hit our first 500 paying customers.
Connect Google Calendar, see your first brief in 90 seconds. No card on file. Cancel from Billing whenever.
