Security & Privacy
BriefPad handles sensitive client intelligence. We built the entire system with a privacy-first architecture.
Our core principle: your clients' data is processed, structured, and stored securely — and audio recordings are never retained.
Zero Audio Retention
Voice recordings are sent to Groq for transcription and immediately discarded. Audio never touches our database.
Encrypted in Transit
All communication uses TLS 1.3. Every API call, every database query, every AI request is encrypted end-to-end.
Password Hashing
Passwords are hashed with bcrypt. We never store plaintext passwords. Even we cannot see your password.
No Tracking
No Google Analytics, no Facebook pixels, no advertising cookies. The only cookies are essential auth tokens.
Account Lockout
After 5 failed login attempts, accounts are locked for 15 minutes. Brute-force attacks are stopped at the door.
Data Deletion
Delete your account and everything is gone — clients, meetings, briefings, all of it. Permanently.
How Audio Processing Works
The original audio file is never written to our database or file storage system. It exists in memory only during the HTTP request, then is garbage-collected.
AI Data Flow
When you generate a briefing or summary, your meeting notes are sent to Groq's AI models for processing. Groq processes the text and returns structured output (briefing, talking points, score). Groq does not retain your data for model training.
- Meeting text → Groq API → Structured briefing → Stored in BriefPad
- No personal data is used for AI model training
- AI-generated content is owned by you
Protecting Your Clients' Data
BriefPad is used by freelancers to log information about their clients — people who are not BriefPad account holders. We take this responsibility seriously.
- Minimal collection: We only store what you choose to log — names, emails, meeting notes, and commitments. We never scrape or collect client data from external sources.
- No audio retention: If you record a voice memo mentioning a client, the audio is processed and immediately discarded. The transcript (text only) is stored in your account.
- No AI training: Your client data is never used to train AI models. Groq processes your text and returns results — nothing is retained for model improvement.
- You control deletion: When you delete a client, all associated data — meetings, briefings, commitments, embeddings — is permanently removed.
- Export anytime: You can export all your data in a portable format from your Settings page.
If a client requests deletion of their information, you can remove it from BriefPad at any time, or contact us at privacy@briefpad.app for assistance.
Infrastructure Security
- Hosting: FastAPI Cloud with managed PostgreSQL
- Database: PostgreSQL with encrypted connections, stored data at rest
- Payments: Stripe (PCI DSS Level 1 compliant) — we never touch card data
- Email: Resend (SOC 2 compliant transactional email)
- Headers: Content Security Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
What We Don't Collect
- Audio recordings (processed and discarded)
- Browser fingerprinting data
- Location data
- Third-party tracking data
- Usage analytics beyond basic server logs
Compliance
BriefPad is designed to comply with:
- GDPR (EU General Data Protection Regulation) — data export, right to deletion, minimal data collection
- CCPA (California Consumer Privacy Act) — opt-out, deletion rights
- SOC 2 principles — access controls, encryption, audit logging
Report a Vulnerability
If you discover a security vulnerability, please report it responsibly to security@briefpad.app. We will respond within 48 hours.