Every document, interview transcript, and SOP you upload to BrainVault is encrypted at rest with AES-256-GCM — the same standard used by governments and financial institutions.
What BrainVault encrypts, where, and how.
| Data Type | Encryption | Status |
|---|---|---|
| Passwords | bcrypt, 12 rounds (industry standard) | ✓ Hashed, never stored in plain text |
| Documents | AES-256-GCM | ✓ Encrypted before database write |
| Interview Transcripts | AES-256-GCM | ✓ Encrypted before database write |
| SOP Content | AES-256-GCM | ✓ Encrypted before database write |
| Share Tokens | Encrypted envelope | ✓ Tokens not readable if DB is compromised |
| Data in Transit (HTTPS) | TLS 1.2+ | ✓ All traffic encrypted end-to-end |
| Session Tokens | httpOnly secure cookies | ✓ Not readable via JavaScript, secure flag in production |
| Analytics Data | IP addresses anonymized (HMAC-SHA256) | ✓ Cannot be re-identified across days |
Every document, interview, and SOP is encrypted before it touches the database. AES-256-GCM is used — a government-grade cipher with authenticated encryption that prevents tampering.
Every database query is scoped to your account. There is zero risk of cross-tenant data access — your firm's knowledge is never visible to any other business.
Login failures return a generic message — "Invalid email or password." Attackers cannot probe your system to discover which accounts exist.
All data between your browser and BrainVault is encrypted with TLS 1.2+. There is no way to intercept credentials or content over the wire.
Sessions are stored in PostgreSQL, not cookies. Session tokens cannot be forged — only the server can validate your session.
GCM mode provides authentication — any tampering with encrypted data is detected immediately. You will know if your SOPs have been modified.
Plain-English explanation of the security model.
Common questions about data security.
Your content is encrypted at the application layer before it reaches the database. Without access to the account's encryption key, BrainVault engineers cannot read your documents, transcripts, or SOPs.
Data is stored in Neon PostgreSQL, a cloud database service. The database runs in a secure, isolated environment with TLS connections enforced. Database credentials are stored as environment variables and never committed to code.
Neon PostgreSQL provides automatic point-in-time recovery and daily backups. Encrypted data is included in backups — the same encryption that protects live data protects your backups.
We will notify affected users within 72 hours of discovering a breach. The authentication tags (GCM mode) make unauthorized tampering detectable. We maintain a security contact at security@polsia.app.
Currently, Polsia manages encryption keys for account access and content encryption. Customer-controlled (bring-your-own-key) encryption is on our roadmap. Contact us if this is a hard requirement.
BrainVault follows SOC 2-aligned security practices. We are pursuing formal SOC 2 Type II certification in 2026. HIPAA-ready architecture is planned. Contact us for a copy of our current security questionnaire.
Start capturing your firm's institutional memory today — protected by AES-256 encryption.
Get Started Free →