Security

All traffic to Briefant is encrypted in transit over TLS. Uploaded videos, extracted screenshots, and generated documents are stored encrypted at rest in object storage.

Every organization's data is isolated with row-level security enforced directly by the database, not just filtered in application code — every query is scoped to your organization at the database layer, so a bug in application code can't leak another organization's data.

Sign-in and account management are handled by Supabase Auth, a dedicated identity provider — Briefant never stores your password. Every request to our API is authenticated with a short-lived, signed token. Two-factor authentication (TOTP, via any standard authenticator app) is available for any account and can be required at sign-in.

Access is enforced server-side on every request, not just hidden in the interface. Owner, admin, member, and guest cover most teams by default — guest is read-only, member manages their own projects, admin manages the team. Custom roles let you define exactly which of the following a role can do: projects, team management, workspace settings, billing, and integrations — each with its own view/manage-level permissions.

A member can never grant a permission they don't themselves hold, and this same permission system is enforced identically whether a request comes from the web app, an API key, or an OAuth-connected application.

API keys can be scoped to specific permissions, restricted to a list of allowed IP addresses, and given an expiration date — all optional, all enforced on every request. Keys are stored hashed, never in plain text, and can be revoked instantly.

Third-party applications you register authenticate via OAuth 2.0's Authorization Code flow with PKCE (required, not optional). A connected application's effective access is the intersection of what it was granted and the connecting user's own current permissions, re-checked on every request — so access shrinks automatically if that user's role changes, with no separate revocation step needed.

Outgoing webhooks Briefant sends to your own endpoints are signed with HMAC-SHA256 so you can verify a request genuinely came from us. Incoming webhooks from our payment and identity providers are verified against their cryptographic signatures before being processed, so a request can't be spoofed by simply knowing our webhook URL.

Security-relevant account actions — role changes, API key revocations, subscription changes, and more — are recorded and reviewable from your workspace settings.

Every change to Briefant runs through automated security scanning before it ships: static analysis, dependency vulnerability scanning, and secret-leak detection, in addition to our test suite.

Your data is never locked in — request a full export of every project's documents, transcripts, and extracted frames (optionally including raw recordings) as a downloadable archive at any time.

If you believe you've found a security issue, email us at security@briefant.com. We'll respond as quickly as we can.