Security
Where your data lives, and who can reach it
Braid holds your customers' conversations. Here is what protects them.
Held in the EU
Your workspace's data — conversations, contacts, knowledge and files — is stored in the European Union, and processed there by the services listed in our sub-processors page.
Encrypted in transit and at rest
TLS on every connection, encryption at rest on the database and on stored files.
Tenant isolation in the database
Separation between workspaces is enforced by row-level security in Postgres, not by application code remembering to filter. A query that forgets a workspace returns nothing rather than someone else's data.
Credentials in a vault
Channel tokens and tool-server credentials are stored encrypted and are readable only by the backend jobs that need them. No screen in the app ever shows a credential back, not even partially.
Roles enforced where it counts
Admin-only actions are checked in the database, not merely hidden in the interface. A non-admin cannot perform one by calling the API directly.
Retention you set
Choose how long conversations are kept, from one month to ten years. Past the window a daily job anonymises them: message bodies, drafts and briefs go, and so do the names, emails and phone numbers of contacts with nothing left inside it. Statistics survive; the personal data does not.
Export and deletion
Request a full export of your workspace whenever you want it. Deleting a workspace disconnects every channel and erases its data after thirty days.
Reporting a vulnerability
Tell us and we will act on it. We do not run a bug bounty, but we do answer, and we will credit you if you would like us to.
The companies that process data on our behalf are listed in sub-processors. What we collect and why is in the privacy policy, and the ways to have data deleted are in data deletion. Security reports go to privacy@getbraid.ai.
Questions a security review needs answered
Send them over — we would rather answer a long list up front than a short one later.