Security and sub-processors

1. How we protect your data

These are the measures running today, not a roadmap.

• Encryption in transit and at rest. All traffic runs over TLS 1.2+ with HSTS. Data is stored encrypted with AES-256 at rest, and so are the backups.
• Your integration credentials, encrypted separately. Access to your calendar, Slack or ClickUp is stored with AES-256-GCM under a key held outside the database. A copy of the database alone will not get anyone into your accounts.
• Two-step verification. With any authenticator app, plus recovery codes in case you lose your phone. Once enabled, a session that has not cleared the second factor cannot read your data — not even by calling the API directly.
• Tamper-proof audit log. File access and sensitive operations are recorded for 12 months, in a table the database itself refuses to let anyone modify or delete.
• Your files, only with permission. They are not served from a public address: every access checks permissions and uses a signed link that expires.
• Workspace isolation in the database. Every table enforces row-level security: the database refuses access to data from a workspace you are not a member of, even if the application gets it wrong.
• Permissions on what you share. A workspace is yours and is never shared. What gets shared is the document or the canvas, with view or edit permission, and that permission is checked on the server on every request, never in the browser alone.
• Sessions with rotating credentials. Session tokens expire hourly and rotate on every refresh; reusing an old one invalidates the session.
• Payments never touch our servers. Paddle processes the charge as merchant of record. We never see or store your card number.
• Real deletion. When you delete your account everything goes — files, documents, meetings, tasks and integrations — removed from live systems immediately: nothing sits in a bin or waits out a period. Backups rotate separately and are fully purged within 90 days.

This page describes how the Service is built today and is updated when that changes. What is agreed lives in the Terms, the Privacy Policy and, for professional customers, the Data Processing Agreement.

2. Compliance

What a legal team asks first, and the short answer to each:

• GDPR. A Data Processing Agreement, published and accepted on signup, with no PDFs going back and forth. It incorporates the European Commission Standard Contractual Clauses, the UK ICO Addendum and the Swiss adaptations.
• Data subject rights. Access, rectification, portability, erasure and objection. Export and deletion run from the application itself, without emailing anyone.
• Real portability. One archive with everything: documents in Markdown and JSON, tasks, meetings, knowledge, and your files inside it. In open formats, so they are useful elsewhere.
• Processors. Every provider involved is under contract, bound by the same obligations we take on.
• Breach notification. Without undue delay, with the information available, completing the rest as it emerges.
• Payments. Processed by Paddle as merchant of record. Your card details never reach our servers.

We are not yet SOC 2 or ISO 27001 certified, and we would rather say so before you ask: what is described here is verifiable, and what is not here, we do not claim.

3. Who else processes your data

To run the Service we rely on the providers below, acting as sub-processors under our instructions and under contract. This list is updated whenever it changes.

• Supabase — database, file storage and authentication. Infrastructure on Amazon Web Services, US East region (North Virginia).
• Vercel — hosting for the site and the web application, plus aggregate usage metrics.
• OpenRouter — routing of AI features to the model provider. Every request is sent with the data policy set to "deny", which restricts routing to providers that do not store or train on the content.
• Groq — transcription of voice notes and meeting recordings. This is the primary provider.
• Cloudflare — backup transcription, running the same model on Workers AI. It only receives audio when Groq fails or runs out of quota, so transcription does not go down. The audio is not stored or used to train models.
• Resend — transactional email: sign-in links, shared-document notices and notifications.
• Paddle — subscription billing as merchant of record, taxes included.
• Google (Analytics) — aggregate usage metrics for the site and the app. No advertising signals and no cross-site tracking.

This list last changed on September 5, 2026 — Cloudflare was added as the transcription fallback. Additions are notified under section 4 of the Data Processing Agreement.

In addition, and only if you turn them on, the integrations connect: Google, Microsoft, Apple (iCal), ClickUp, Notion, Slack, WhatsApp and Telegram, plus any AI client you connect over MCP. Each asks for its own consent and disconnects from the application, revoking access immediately. What each one touches is detailed in the Privacy Policy.

We do not sell or monetize personal data, and your content is not used to train generalized artificial intelligence models.

4. Reporting a vulnerability

If you have found a security problem, email us at hello@secondbrain.media with the details and the steps to reproduce it.

We do not run a bounty programme: we do not pay for reports, but we will credit you publicly if you want.

5. Contact

Any question about this page, about the sub-processors or about how we handle data: hello@secondbrain.media.