Trust & Security
Treat incident data like it's privileged. Because it often is.
Crisis data is price-sensitive, personal and sometimes under legal privilege. Briefroom is built so that nothing leaves without a human, and everything is on the record.
Human approval on every send
Agents and assistants can only draft and request. A named approver signs off every email; severity 4 and regulator recipients need a second approver. Expired requests send nothing.
Tenant isolation
Every row carries your organisation id and is protected by row-level security. Your knowledge, incidents and embeddings never mix with another customer's.
EU hosting option
Run Briefroom in an EU region. Enterprise plans can use a private deployment.
No training on your data
Your incidents and documents are never used to train models without explicit opt-in. Our subprocessors, Anthropic for AI models and ElevenLabs for agent voices, work under data processing agreements and don't train on it either.
Full audit log
Every draft, edit (with diff), approval, rejection and MCP tool call is recorded with the actor, client and timestamp.
Guardrails on every draft
A legal-risk reviewer checks for admissions of liability, defamation risk, speculation about individuals and market-sensitive disclosure. Hard stops tell you to call your lawyer.
Scoped MCP access
OAuth 2.1 with PKCE and per-client scopes. There is no scope that sends email directly.
Honest AI
Rehearse personas are fictional and labelled as AI. Drills grade words, timing and decisions — never inferred emotions.
Questions
Do you sign a DPA?+
Yes, from day one, on every plan.
Where is data stored?+
In our primary region by default, with an EU hosting option. Enterprise customers can choose a private deployment.
Who can see our incidents?+
Only members of your organisation, within their department permissions. Experts see an incident only after an admin approves their engagement.
Can an AI agent send something without us?+
No. Voice never sends, MCP has no direct-send scope, and every email request needs a named approver.
Do you use our data to improve the product?+
Not without your opt-in. With consent, an expert-handled incident can become a private or anonymised scenario.
Be ready before the call comes.
Capture your comms style, put advisors on call, schedule monitoring and set your approvers in an afternoon, so the first hour of a crisis is already planned.
press@northwindpay.example