The principle
Executive context is more sensitive than passwords or documents. It reveals how you think, who you trust, and what you are about to decide. Brief is built on one principle about that context: no human at Brief can read it.
How that is enforced
- Your emails, chats, calendar events, and documents are encrypted before they are stored, using a key that is unique to you. Not a shared key. Not a platform key.
- Brief uses AES-256-GCM field-level encryption. Your personal encryption key is itself encrypted and stored separately in Google Cloud Key Management Service.
- Even if someone exfiltrated the Brief database, they would receive ciphertext that is useless without your key, which they would not have.
- All data is encrypted in transit (TLS) and at rest. Access between Brief's internal services is authenticated via Google Cloud IAM, and every data access is written to an audit log.
- No engineer, no founder, and no support agent at Brief has a path to your decrypted content. No support ticket, no internal investigation, and no change in company leadership changes that.
This is not a policy. It is architecture. Policies can be rewritten. An architecture cannot grant access it was not built to grant.
What Brief stores, and what stays in your source systems
Brief stores encrypted copies of the content it needs to do its job: relevant emails, chat messages, calendar events, documents, and transcripts. Brief also generates metadata such as summaries, keywords, tags, and inferred relationships, which power your briefings and answers.
Your originals always remain in your source systems (Gmail, Outlook, Google Calendar, Microsoft Calendar, Google Chat, Zoom, and the rest). Brief maintains a pointer back to each one. Brief is not your system of record.
If you delete content at its source, Brief loses access to it.
Sign-in security
Brief does not have its own password. Sign-in goes through Google or Microsoft OAuth. The implication is direct: the security posture of your Brief account is the security posture of the underlying Google or Microsoft account. Use a strong password and two-factor authentication on that account.
How language models reason over your content
To generate your briefings and answer your questions, Brief decrypts the relevant portions of your content and sends them to a language model. Brief uses Vertex AI, Google's enterprise AI platform. Under Google's standard terms for Vertex AI, your inputs are not used to train Google's foundational models. That is a contractual commitment, and a meaningful one.
Brief does not route your content to any other LLM provider.
Isolation
The most important thing to know about confidential information in Brief: your data is isolated by user, encrypted with keys specific to you, and processed only to produce output for you. It is not used to improve Brief's models, and it is not visible to any other user, including other people at your own company.