Trust center
How we protect the knowledge of your Workspace: the controls we run, our certifications, the sub-processors in each region and who does what in each tier. The data on this page comes from files in our repository. A change to those files changes this page.
Status page · Sub-processor list (JSON) · security.txt
Certifications
SOC 2 Type I Planned
Before the first paid customer (SEC5).
SOC 2 Type II Planned
Within 12 months after Type I (SEC5).
ISO/IEC 27001 with 27017 and 27018 Planned
In one audit
GDPR and UK GDPR In progress
DPA with standard contractual clauses or the UK IDTA
Controls
Each control area maps to requirement IDs of our specification and to the framework controls. An auditor can go from a control to the code, the test and the evidence.
| Area | Requirements | SOC 2 | ISO 27001 | ISO 27017 / 27018 | GDPR |
|---|---|---|---|---|---|
| Tenant isolation | TEN, HOST-10..HOST-14, AUTHZ | CC6.1 | A.8.3 | CLD.9.5.1 | art. 32 |
| Identity and sessions | IAM-01..IAM-39 | CC6.1, CC6.2, CC6.3 | A.5.15, A.5.16, A.5.17, A.5.18, A.8.5 | — | art. 32 |
| Staff and support access | IAM-18, IAM-42 | CC6.1, CC6.6 | A.8.2, A.8.18 | CLD.12.1.5 | art. 28, art. 29 |
| Audit and monitoring | AUD | CC7.2, CC7.3 | A.8.15, A.8.16, A.8.17 | CLD.12.4.5 | art. 33 |
| Supply chain and change | SDLC | CC7.1, CC8.1 | A.8.8, A.8.25..A.8.33 | — | art. 25 |
| Hardening and network | INF, DNS-05 | CC6.6, CC6.7, CC6.8 | A.8.9, A.8.20..A.8.24 | CLD.9.5.2, CLD.13.1.4 | art. 32 |
| Destructive operations | INF-07 | CC8.1 | A.8.32 | CLD.12.1.5 | — |
| Backup and recovery | AVL | A1.1, A1.2, A1.3 | A.5.30, A.8.13, A.8.14 | — | art. 32 |
| Encryption and secrets | DATA-08..DATA-09 | CC6.1, CC6.7 | A.8.24 | — | art. 32 |
| Classification and inventory | DATA-01..DATA-02 | C1.1 | A.5.9, A.5.12 | 27018 | art. 30 |
| Residency and transfers | DATA-03..DATA-04, PLANE-08 | — | A.5.34 | 27018 location | ch. V |
| Data subject rights | DATA-05 | — | A.5.34 | 27018 | art. 15..art. 20 |
| Erasure | DATA-06..DATA-07, DATA-13..DATA-14 | C1.2 | A.8.10 | CLD.8.1.5, 27018 | art. 5, art. 17, art. 28 |
| No secondary use | DATA-11 | C1.1 | A.5.34 | 27018 | art. 5, art. 28 |
| Analytics | ANL | C1.1 | A.5.34, A.8.11 | 27018 | art. 5, art. 6, ePrivacy art. 5(3) |
| Consent and trackers | CMP | P-series (Privacy) | A.5.34 | 27018 | art. 6, art. 7, ePrivacy art. 5(3) |
| Compliance management and evidence | GRC, AUD-12, AUD-13, AUD-14 | CC1..CC5 | cl. 4..cl. 10, A.5.1..A.5.37 | — | art. 5(2), art. 24, art. 30 |
| Disclosure and transparency | DATA-16..DATA-17, CLD-02 | — | A.5.19..A.5.23 | 27018 | art. 28 |
| Responsibilities | CLD-01 | CC2.3 | A.5.2 | CLD.6.3.1 | art. 28 |
Sub-processors
Your data stays in the jurisdiction of your Workspace. We tell Workspace Owners by email and webhook 30 days before we add or change a sub-processor. Last change: 2026-11-01.
European Union
| Sub-processor | Purpose | Data | Location | Tiers | Status |
|---|---|---|---|---|---|
| Microsoft Azure | Cloud hosting of the EU control plane and the EU cells (compute, databases, object storage, backups, key service, logs) | customer content, account data, audit log | European Union (West Europe, North Europe; backup copies in the paired EU region) | Dedicated, In your cloud | Planned |
| Azure OpenAI Service | AI model endpoint for the model gateway, zero data retention, no training | customer content in prompts | European Union (West Europe or Sweden Central) | Dedicated | Planned |
| Amazon Web Services | Cloud hosting of Dedicated cells on AWS (compute, databases, object storage, backups, key service) | customer content, audit log | European Union (eu-west-1 Ireland, eu-central-1 Frankfurt) | Dedicated | Planned |
| Amazon Bedrock | AI model endpoint for Dedicated cells on AWS, zero data retention, no training | customer content in prompts | European Union (eu-central-1, Frankfurt) | Dedicated | Planned |
| Email delivery provider (not chosen yet) | Send sign in links, invitations and notices | email address, name | European Union | Dedicated, In your cloud | Planned |
United Kingdom
| Sub-processor | Purpose | Data | Location | Tiers | Status |
|---|---|---|---|---|---|
| Microsoft Azure | Cloud hosting of the UK control plane and the UK cells (compute, databases, object storage, backups, key service, logs) | customer content, account data, audit log | United Kingdom (UK South; backup copies in UK West) | Shared, Dedicated, In your cloud | Active |
| Contabo | Hosting of the demo server (compute and disk); demo data and test accounts only | account data of test accounts, demo content | United Kingdom | Shared | Active |
| Azure OpenAI Service | AI model endpoint for the model gateway, zero data retention, no training | customer content in prompts | United Kingdom (UK South) | Shared, Dedicated | Active |
| Amazon Web Services | Cloud hosting of Dedicated cells on AWS (compute, databases, object storage, backups, key service) | customer content, audit log | United Kingdom (eu-west-2, London) | Dedicated | Planned |
| Amazon Bedrock | AI model endpoint for Dedicated cells on AWS, zero data retention, no training | customer content in prompts | United Kingdom (eu-west-2, London) | Dedicated | Planned |
| Email delivery provider (not chosen yet) | Send sign in links, invitations and notices | email address, name | United Kingdom | Shared, Dedicated, In your cloud | Planned |
Shared responsibility
Who is responsible for each area in each tier.
| Area | Shared | Dedicated | In your cloud |
|---|---|---|---|
| Patching | Brainfold We patch the hosts | Brainfold We patch the dedicated cluster and database in the maintenance window of the customer. | Shared We release patched images and charts. The agent applies them. The customer patches its cloud account. |
| Encryption keys | Brainfold Each Workspace has its own key in our key service. Keys rotate automatically. | Brainfold The cell has its own keys in our key service. Keys rotate automatically. | Customer The cell uses the key service of the customer. |
| Backups | Brainfold We back up and test restores every week. | Brainfold We back up and test restores every week. | Shared The chart configures backups to the customer's storage. The customer keeps the storage and its retention. |
| Network | Brainfold We run the network and the edge. Network policies isolate the cell. | Shared We run the dedicated network. The customer sets the private link and the IP allow list. | Customer The customer runs the network. The cell makes only outbound calls. |
| Identity | Shared We run sign in. The customer connects its identity provider and manages Users and roles. | Shared We run sign in. The customer connects its identity provider and manages Users and roles. | Shared We run sign in. The customer connects its identity provider and controls our scoped access role. |
| AI provider | Brainfold We choose an in region provider with zero retention and no training terms. | Shared The customer selects an in region provider from our list. We operate the connection. | Customer The cell uses the AI endpoint of the customer. |
| Monitoring | Brainfold We monitor the cell. Admins see the audit log and the health page. | Brainfold We monitor the cell. The customer can stream the audit log to its SIEM. | Shared We get health metrics only. Logs and traces stay in the customer account. |
Privacy, cookies and trackers
We are the controller of the data about visitors of this site and users of the product. Optional trackers run only after your consent. We use no third party tracker and no advertising tag. Analytics are cookieless, self-hosted and pseudonymous. Your choice stays valid for 180 days. Privacy notice version 2026-10-17.
Strictly necessary Always on
These keep the site secure and remember your consent choice. You cannot turn them off.
Functional Your choice
These remember optional settings. We do not use any now.
Analytics Your choice
These count page views and product events without cookies and without your name, email or IP address.
Marketing Your choice
These measure campaigns. We do not use any now.
| Name | Category | Vendor | Purpose | Cookies and storage |
|---|---|---|---|---|
| Consent choice | Strictly necessary | Brainfold (Consenti widget, self-hosted) | Remembers your consent choice and a random consent id, so that the banner does not ask again. | consenti_data, consenti_visi_* |
| Workspace session | Strictly necessary | Brainfold | Keeps you signed in to your Workspace and protects forms against cross-site requests. | bf_at, bf_rt, bf_csrf, bf_after |
| Staff session | Strictly necessary | Brainfold | Keeps our platform staff signed in to the staff pages. | bf_staff, bf_staff_csrf |
| Product and website analytics | Analytics | Brainfold (Umami, self-hosted) | Counts page views and declared product events with pseudonymous ids. No cookies and no raw IP addresses. | — |
Report a security problem
Send the details to security@brainfold.ai. We send a reply to each report. Do not access data that is not yours. Do not run tests that make the service slow for other customers.