Where client data is stored, how it is encrypted, who can read it and how long it is kept. Short on purpose, and each answer names the mechanism behind it.
Client records, briefs, transcripts and recordings are kept in Australia. To draft, transcribe and deliver, Briefi sends the content one task needs to a specialist provider. Several of them are outside Australia, including in the United States.
Briefs, recaps, follow-up emails and inbox triage.
Recordings, and live captions when you switch them on.
Joins Zoom, Teams or Google Meet when you send it.
Delivering the email Briefi sends, and billing your subscription.
Sensitive content is encrypted before it reaches the database, with a key that belongs to your workspace alone. It is decrypted on the server only when a signed-in member with access opens it.
A 256-bit key that never reaches a browser and is never stored in the database.
Wraps every workspace keyA random 256-bit key created for your workspace and stored only in wrapped form.
Unwrapped in server memory, brieflyOne workspace's key cannot open another workspace's records.
Stored as ciphertext in SydneyValues the database must search or sort on, such as names, email addresses, dates and statuses. The access rules below protect them. Every connection is HTTPS only, and the browser is told to insist on it (HSTS).
Between practices, between colleagues, and between your practice and us.
Codes from an authenticator app, available to every user.
Google, Microsoft and CRMs connect by OAuth, asking only for the access the features you turn on need. Their tokens are encrypted, and you can revoke them from the provider.
Briefi's use of information received from Google Workspace APIs, including any raw or derived data, adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use, transfer or sell Google user data to create, train or improve any generalised or foundational AI or ML model.
Your records stay while your workspace is active, with these exceptions.
| Record | How long |
|---|---|
| Recording audio | Deleted after 7 days by default. Set anywhere from 1 to 90 days in workspace settings. |
| Meetings and transcripts | Kept, encrypted, until you delete them or the workspace. |
| A deleted account | Recoverable for 90 days, then permanently removed. |
| A paused workspace | Kept for 90 days, then deleted. If you had a trial or a plan, we email the workspace owner first. |
Yes. Our DPA is published and covers the Privacy Act, GDPR and the UK Addendum. If your practice needs a signed copy, email us and we will prepare one for you.
Email privacy@briefi.shRead the DPAThe current list, with what each receives and where it is hosted, is public. Workspace owners get at least 30 days of notice before a new subprocessor handles customer data.
Open the subprocessor listIt is stored in Sydney. To draft, transcribe and send, Briefi passes the content one task needs to a specialist provider, and several are outside Australia. Those transfers are covered by APP 8 and, for EU and UK data, the Standard Contractual Clauses.
Briefi does not train AI models on your content, and we do not sell it or share it with advertising networks. Content goes to a provider only to complete the task you asked for. The providers and what each receives are on the subprocessor list.
Only if an owner or admin grants support access, for up to seven days. It is read-only unless you allow more, every visit is recorded in your audit log, and you can end it at any time.
We notify the workspace owner within 48 hours of becoming aware of it, with what is known about its scope and what we are doing. That leaves you time for your own assessment under the Notifiable Data Breaches scheme.
An owner or admin can download any client’s full record as one file from their contact page, which is also how you answer an access request. Plans with API access can pull meetings, contacts, deals and threads through the API. For the whole workspace, email us and we will export it for you.
Email support@briefi.shWe do not run a bug bounty, but every security report is read personally and we reply as soon as we can. Please give us a fair chance to fix an issue before you disclose it.
security@briefi.shprivacy@briefi.shPrivacy requests are answered within 5 business days.
A 30-minute walkthrough, with time to go through your own checklist.
Last reviewed October 2026