Security at Braintunnel

Last updated: May 12, 2026

We take the security and privacy of your information seriously. On our hosted service, your email, notes, and related data are protected with technical and organizational safeguards designed to protect the confidentiality, integrity, and availability of your data. This page summarizes our security practices; it is not a contract. For how we use personal data, see our Privacy Policy. For the rules of using the product, see our Terms of Service.

Braintunnel is currently in invite-only private beta, limited to approximately 100 users while we validate and harden the system.

What you're entrusting us with

Depending on what you connect, Braintunnel may process:

Email — when you connect an account via Google APIs, content syncs and is stored to power search, the inbox, and assistive features. We access only the scopes necessary to provide these features, and our use of data received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Wiki and files — markdown and related files you keep in your workspace.
Calendar-related data — when you connect your calendar via Google APIs, we may cache enough information to show your schedule in context. We request only the minimum calendar scopes needed for this functionality.
Google Drive data — when you connect Google Drive via Google APIs, we use read-only access to index selected Drive files and make them available to search, Hub, agent, and assistive features. We do not request write access to your Drive.
Basic Google profile — when you sign in with Google, we receive basic profile information such as your name and email address so we can create and identify your account.

We treat that data as yours. We use it to run the service for you, not to build unrelated profiles or to sell to advertisers. We do not use your data for purposes unrelated to providing and improving the Braintunnel service.

Third-party integrations

Braintunnel connects to third-party services to provide its functionality. We apply the following principles to all integrations.

Minimum necessary access

We request only the permissions, or OAuth scopes, required to provide the specific features you use. We do not request broad or unnecessary access to your accounts.

Google APIs

Braintunnel's access to Google user data, including basic profile information, Gmail, Google Calendar, and read-only Google Drive data, is governed by the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We use Google user data only to provide and improve the Braintunnel service features you have requested, including sign-in, search, inbox, calendar context, Hub and agent features, and Drive/document indexing.
We do not transfer Google user data to third parties except as necessary to provide or improve the service, to comply with applicable law, or as part of a merger, acquisition, or asset sale with adequate notice to users.
We do not use Google user data for serving advertisements or for any purpose unrelated to the Braintunnel service.
Human access to Google user data is limited to security purposes, compliance with applicable law, internal operations where the data is aggregated and anonymized, or where you provide affirmative consent.

Revocation

You may disconnect any integration at any time through the product. Upon disconnection, we cease accessing new data from that integration and delete previously synced data from our active systems in accordance with our data retention practices described in our Privacy Policy.

Sign-in and sessions

You sign in with Google using standard OAuth 2.0, including protections such as PKCE (Proof Key for Code Exchange), a security measure that prevents authorization code interception attacks.
Sessions are established with a secure, HTTP-only cookie, which is not readable by page scripts, and are scoped to your account. We use HTTPS for all traffic between your browser and our service so session traffic is encrypted in transit.
Sessions expire after a defined period of inactivity. You may also sign out manually at any time to terminate your session.

How we keep accounts separate

Braintunnel is built so one user's data is not mixed with another's. Requests are tied to your session; the application enforces path and permission checks so file and API access stay within your own workspace. Automated tests help ensure isolation for key workflows. We maintain logical separation of user data at the application layer so that one user cannot access another user's content through the service.

Infrastructure and encryption

In transit: all connections from your browser to Braintunnel use TLS 1.2 or higher (HTTPS). Connections between Braintunnel and third-party services, including AI providers, are also encrypted using TLS.
At rest: on our hosted environment, the disks that store your data use provider-managed encryption at the storage layer, AES-256 or equivalent, which protects data if physical media were lost or mishandled. While the service is running, authorized software still reads data as needed to operate the product, as with any cloud app.
Network: the application is placed behind a load balancer and firewall rules so the app port is not exposed directly to the open internet; only the expected path from the edge to the app can reach it. Administrative access to servers is restricted, such as by avoiding broad public SSH and using private, authenticated paths for operators.
Access controls: access to production systems is limited to authorized personnel on a need-to-know basis. We maintain access logs and review access periodically.

Artificial intelligence, data processing, and your content

When you use chat or agent features, content relevant to your request — which can include email bodies, wiki text, search or tool results, and similar — may be sent to third-party AI providers, for example Anthropic or OpenAI, to generate answers.

Data usage limitations for AI processing:

Purpose limitation — content is sent to AI providers solely to generate responses to your specific requests. We do not send your data to AI providers for any other purpose, including advertising, profiling, or analytics unrelated to your request.
No model training — our agreements with AI providers contractually prohibit them from using your data to train, improve, or fine-tune their models. Your content submitted through Braintunnel is not used as training data.
Data minimization — we send only the content reasonably necessary to fulfill your specific request. We do not send your entire mailbox, file library, or workspace to AI providers; only the content relevant to the query or task is transmitted.
No persistent storage by providers — under our agreements, AI providers are required to delete input and output data within a short retention window, typically 30 days or less, and may not retain your content beyond what is necessary to provide the immediate response, unless a longer period is required by law.
Transit encryption — all API calls to AI providers use TLS encryption. We do not transmit your content to AI providers over unencrypted channels.

Important: There is no separate automated redaction step in the product today. You should assume that data the features need to answer you may be included in those API calls. If you are not comfortable with that tradeoff, limit what you connect or avoid agent features that read sensitive material.

We log operational information, such as errors and high-level request metadata, to keep the service reliable; we do not design routine logs to store full email or wiki body content. Log data is retained for no longer than 13 months and is used solely for service reliability, debugging, and security monitoring.

Retention, backups, and private beta

We are in private beta as we grow. We do not currently perform user data backups — out of an abundance of caution, we avoid copying all customer data into additional stores until we can do so with controls we are comfortable standing behind. We expect to offer secure backups before general availability, and we will update this page when that changes. Broader backup and disaster-recovery practices will continue to evolve with the product.

When we do implement backups, they will be encrypted at rest and subject to the same access controls as production data. We will not back up email or calendar data sourced from connected integrations, as described in our Privacy Policy.

Incident response

In the event of a security incident that results in unauthorized access to, or disclosure of, your personal information, we will:

Investigate the incident promptly and take steps to contain and remediate the issue.
Notify affected users without unreasonable delay, and in any event within the timeframes required by applicable state data breach notification laws, typically no later than 60 days following discovery, or sooner where required by law.
Notify applicable regulatory authorities as required by law.
Provide information about the nature of the incident and steps you can take to protect yourself.

Reporting security issues

If you believe you've found a security vulnerability, please email security@braintunnel.io rather than disclosing in public forums. We appreciate responsible disclosure and will work with you to understand and address valid reports. We aim to acknowledge receipt of vulnerability reports within 3 business days.

Changes

We may update this page as the product, infrastructure, or threat landscape changes. The "Last updated" date at the top will change when we make material edits. Where changes materially affect how we handle your data, we will provide notice in accordance with our Privacy Policy.

This page is meant to help you make informed decisions. It does not list every control, dependency, or internal process. For detailed engineering notes, our team maintains separate internal documentation.