Data processing, on your terms.

Under the GDPR, your firm is the data controller. You decide what personal data enters your compliance operation and why. Brayns acts as a data processor, handling that data only on your instructions and only to run the workflows you have configured. A data processing agreement governs the relationship and forms part of every customer contract.

Brayns runs inside your own environment. Your policies, your case history and the personal data they contain stay where they already sit. We do not move your data into a shared platform, and we do not pool it with any other customer. Data residency is a deployment choice you make, not a promise we ask you to trust.

Nothing from your operation is used to train a model that serves anyone else. Your cases and decisions make Brayns sharper at your compliance, inside your instance, and nowhere else. What is yours stays yours.

Brayns processes the personal data needed to carry out the compliance tasks you assign: customer records, transaction detail, screening results and the case notes that go with them. It processes that data to run your SOPs, clear routine cases, escalate the ones that need a person and keep a complete audit trail. It does not process personal data for any purpose you have not set.

Access is controlled and least-privilege. Data is encrypted in transit and at rest. Every action the system takes is logged with its reasoning, which means the processing itself is auditable rather than opaque. We follow recognised security practices and support the controls your own risk and security teams require.

We keep the number of sub-processors small and use them only where they are needed to deliver the service. Where a sub-processor is involved, it is bound by data protection terms consistent with this page and with your data processing agreement. A current list of sub-processors is available to customers on request.

As the controller, your firm remains responsible for the lawful basis of processing and for responding to data subject requests. Brayns is built to support those obligations: because every decision is traceable and the data stays within your environment, retrieving, correcting or deleting records is straightforward. We assist with data subject requests, deletion and audits as set out in the data processing agreement.

This page is informational and not legal advice. The binding terms are those in your data processing agreement.

Questions about data processing or to request our sub-processor list or DPA? Email contact@brayns.ai