How Sidebrain Keeps Your Data Secure

When you connect your email, calendar, and work tools to an AI, security isn't optional — it's essential. Here's how we protect your data.

Our Security Philosophy

Principle 1: Minimize Data Storage

We don't store your emails, calendar events, or document contents. When you ask Sidebrain to check your email, we:

1. Fetch the data in real-time
2. Process it with the AI
3. Return the response
4. Discard the raw data

Your data passes through, it doesn't live with us.

Principle 2: Your Keys, Your Control

With BYOK (Bring Your Own Key), your AI requests go directly to OpenAI or Anthropic using YOUR API key. We never see your prompts or responses at the API level.

Principle 3: Minimal Permissions

We only request the permissions we need:

• Gmail: Read-only (we can't send without your approval)
• Calendar: Read-only (we can't create events without your approval)
• GitHub: Read + limited write (with your explicit action)

Technical Security Measures

Encryption

• In Transit: All connections use TLS 1.3
• At Rest: Sensitive data encrypted with AES-256
• OAuth Tokens: Encrypted and stored separately from user data

Authentication

• Powered by Clerk (enterprise-grade auth)
• Support for SSO, 2FA, and magic links
• Session tokens with automatic expiration

Infrastructure

• Hosted on Vercel (SOC 2 Type II compliant)
• Database on Supabase (SOC 2 Type II compliant)
• No data stored in regions you don't approve

BYOK: The Security Advantage

When you use your own API key:

1. Your prompts stay yours — We don't see what you're asking
2. No vendor lock-in — Your key works anywhere
3. Audit trail — See exactly what's being used in your OpenAI/Anthropic dashboard
4. Rate control — Set your own limits

What We DO Store

For transparency, here's what we keep:

• Your account info (email, name)
• Your connected integrations (which apps, not the data)
• Your saved notes and memories (encrypted)
• Usage metrics (anonymized)

What We DON'T Store

• Email contents
• Calendar event details
• GitHub code or issues
• Notion page contents
• Your AI conversation history (optional)

Compliance

• GDPR: Full compliance, data deletion on request
• CCPA: California privacy rights supported
• SOC 2: In progress (via our infrastructure partners)

Questions?

Security questions? Email us at [email protected]

Want to report a vulnerability? We have a responsible disclosure program.

---

Trust is earned. We're committed to being the most transparent AI assistant on the market.