Security at OzBrain
Updated
OzBrain holds knowledge your agents read and write. Every claim on this page is either something you can check in your account, or an architecture explanation you can verify in the open design.
OzBrain does not train on your brain
OzBrain never uses your content to train foundation models and never sells it. Connected agents process it on your subscription when they call the connector. What those platforms do with content they receive is governed by their terms on your account.
An append-only log you can export
Writes, promotions, disputes, and task events land in an account log you can open and export as CSV (up to 5,000 events per download). Event rows are append-only. Displayed titles follow the current article or task name when those change later.
Per-client access you can revoke
Agents connect through OAuth 2.1. Each client appears in Connections with revoke. There are no long-lived API keys to leak. Revoke cuts that client.
Per-account encryption at rest
Article and version bodies sealed under a key unique to your account. Titles and the routing index stay readable so agents can navigate. Bodies decrypt only on the request path: when your connected agent reads or writes, and during disclosed maintenance.
Maintenance loop
Scheduled coherence passes that keep the brain true as agents write: decay, audit, and reconsolidation on a cadence you can see in the log.
How it works
Tenant isolation in the database
Every knowledge row is account-scoped. Row-level security is forced in Postgres for bearer reads. Agent writes go through SECURITY DEFINER database functions that re-check tenant scope before any mutation. Hostile cross-tenant cases live in the automated test suite.
Immutable version history
Canon writes land as version snapshots. You can inspect what changed and which actor wrote it. Staged writes promote only with an explicit decision; conflicts surface instead of silently overwriting.
The inference boundary
Models see your content when your own connected agent reads or writes it through the connector. OzBrain does not mine, sell, or train on customer brain content. Your connected platform's handling follows that platform's terms.
Transport
The product is served over HTTPS. Auth and data store on Supabase; the app runs on Vercel.
Who touches your data
Every party that can see content or account data in the course of providing the service. The last row is the one most tables omit: the AI platform you connect is a recipient on your account, under that platform's terms.
| Party | Region | Purpose | Data | Retention |
|---|---|---|---|---|
| Supabase | Configured project region | Authentication, Postgres, and OAuth grants | Account identity, brain content and versions, Chronicle, OAuth connections, rate-limit bucket keys (visitor IP and email identifiers for abuse caps), and connector onboarding sessions (email plus auth token hashes for visitors who have not finished signup) | Account data for the life of the account. Rate-limit buckets and unfinished onboarding sessions can outlive a signup attempt; onboarding tokens stop working after expiry |
| Vercel | Edge and function regions serving ozbrain.co | Application hosting and request delivery | HTTPS traffic, standard request logs, deployment metadata | Per Vercel platform defaults |
| NitroSend | Provider regions for email delivery | Transactional and lifecycle email | Email address, activation attributes, authentication emails with one-time action links (sign-in, recovery, email change), and About contact-form submissions (name, email, message body) | While your account receives product email, or until you ask us to stop. Auth action links expire per Supabase auth settings. Contact submissions are retained for support handling |
| Your AI platform | Wherever that provider runs your client | Runs the agent you connect (Claude, ChatGPT, Cursor, and others) | Whatever that client reads or writes through the OzBrain connector on your account | Under that platform's terms, on your subscription, controlled by you |
Report a concern
Security reports: security@monsef.com. OzBrain is a product of Monsef Holdings Pty Ltd, Melbourne, Australia.