Security
Last updated 2026-11-04
How Brainpot protects your team's context, in plain words.
Encryption
- All traffic uses TLS.
- Page overviews, facts and history are encrypted in the database with XChaCha20-Poly1305 and a key of their own per workspace. That key is stored only encrypted with a master key kept outside the database, so a copy of the database is unreadable.
- Search uses keyed hashes of words, never plaintext.
- Deleting a workspace deletes its key, which makes any leftover copies, backups included, unreadable.
Who can read your content
Your teammates, according to the access an admin sets, and the AI tools they connect, which never see more than the person behind them. To answer those tools, our servers decrypt content while serving a request. Our staff have no tool for viewing it. For content even we must never be able to read, Large Teams will offer sealed pages, encrypted on your devices.
Sign-in
No passwords. Email links work once and expire after 15 minutes. Passkeys are bound to Brainpot's domain, so a fake login page can't capture them. Connected AI tools use OAuth with PKCE or personal tokens, which you can revoke at any time; removing a member cuts off their tools at once.
History, export and backups
Every change is versioned and can be restored. You can export everything as Markdown and JSON at any time. Encrypted backups are kept for 30 days.
Subprocessors
| Company | Purpose | Location |
|---|---|---|
| Oderland Webbhotell AB | Servers and database | Sweden |
| Sendinblue SAS (Brevo), France | Sign-in and invite emails | EU |
| Stripe Payments Europe Ltd. | Payments and invoices | Ireland, EU |
We give 30 days' notice by email before this list changes.
Report a vulnerability
Email [email protected]. We reply within two working days and credit researchers who report responsibly.