Security & Data Handling

How we think about security

When we build an AI knowledge system on your documents, that system should only ever work for you. This page explains, in plain language, how we handle hosting, data and AI model vendors — and where we are today on formal certifications.

Data handling

Documents and data you share with us for a project are used only to build and operate your own system. We do not use client documents to train shared or third-party models, and we do not repurpose one client’s content for another client’s project.

Hosting & infrastructure

Braidstack-built systems are typically deployed on cloud infrastructure (AWS/GCP) or on infrastructure you specify, depending on the project. This website itself is served over HTTPS with HSTS enabled, so connections to it are encrypted in transit.

AI model vendors

Depending on a project’s requirements, we build on established AI infrastructure such as OpenAI, Anthropic (Claude) and Google (Gemini) APIs, along with open frameworks like LangChain and LangGraph. Which vendor we use, and whether processing happens via a hosted API, a private cloud (VPC) deployment, or on-premises, is a decision we make with you based on your data sensitivity and compliance needs — ask us on a call.

Certifications

We do not currently hold formal third-party certifications such as SOC 2 or ISO 27001. If your organization requires these as part of a vendor review, let us know early in the conversation — we’re happy to discuss your specific security and compliance requirements and what we can commit to in a written agreement.

Access & credentials

Access to client systems and documents is limited to the people actually working on your project. Credentials and API keys are not shared between client engagements.

Reporting a concern

If you have a security question or want to report a concern about a Braidstack-built system or this website, email us at hello@braidstack.com and we’ll respond promptly.

Last updated: August 7, 2026