Security

1.Overview

Security is the foundation BriefNest is built on — you’re trusting us with the contents of your meetings, which often include strategy, personnel matters, and unreleased plans. This page describes the technical, operational, and organizational controls we use to protect that trust.

2.Encryption

All data in transit between your device, our servers, and our AI-processing pipeline is encrypted using TLS 1.2+. Meeting audio and scanned note images are encrypted at rest with server-side encryption (AES-256). Transcripts, generated briefs, key points, decisions, action items, discussion threads, and OCR text are additionally encrypted at the application layer (AES-256-GCM) before being written to our database, so this content is not readable directly from the database.

3.Infrastructure & hosting

BriefNest runs on reputable cloud infrastructure providers with physical security, redundant power, and network protections at the data-center level. Production environments are isolated from staging and development, and infrastructure changes go through code review and automated testing before deployment.

4.Compliance & certifications

Our data practices are designed to align with GDPR and CCPA/CPRA requirements. We are pursuing SOC 2 Type II certification; our current sub-processor list is available on request via our Trust Center.

5.Access controls & authentication

Customer accounts support strong password requirements, and organizations on Team and Enterprise plans can enforce to have strong password. Internally, access to production systems and customer data is restricted on a least-privilege basis, requires MFA, and is logged and reviewed on a regular cadence. Employee access is revoked immediately upon offboarding.

6.Recording & AI-processing safeguards

BriefNest never joins your meeting as a bot or third-party participant — recording happens locally on your device, under your control. Audio and text sent for AI processing are:

• Scoped to your account’s isolated processing context;
• Never used to train shared or third-party AI models;
• Discarded from the active processing pipeline once your brief is generated, retaining only the output you keep.

7.Data isolation & retention

Customer data is logically separated by account and organization. Database backups are managed by our hosting provider and encrypted at rest; deleted content is purged from production within 30 days and from backups within 90, consistent with our Privacy Policy.

8.Vulnerability management & testing

We run continuous automated vulnerability scanning across our codebase and infrastructure, and commission independent third-party penetration tests at least annually. Findings are triaged and remediated on severity-based timelines before being closed out.

9.Incident response

BriefNest maintains a documented incident response plan covering detection, containment, eradication, and recovery. If an incident affects customer data, we notify affected organizations without undue delay and in line with applicable legal requirements.

10.Responsible disclosure

If you believe you’ve found a security vulnerability, please report it to security@briefnest.ai. We ask that you give us a reasonable window to investigate and remediate before public disclosure, and we commit to acknowledging reports promptly and in good faith.

11.Sub-processors

We use a limited set of vetted infrastructure and AI-processing sub-processors, each bound by data-protection agreements consistent with this page and our Privacy Policy. A current list is available on request at privacy@briefnest.ai.

12.Contact

Security questions or to report a concern: security@briefnest.ai.