Company Brain is designed for a customer-controlled production environment, with a bounded deployment scope and explicit responsibility lines. Security and procurement requirements are assessed before production go-live.
One isolated production environment is deployed into infrastructure you provide and control. In the standard configuration, document content and inference stay inside that environment; a premium hosted model is optional and off unless you enable it.
Source credentials are encrypted before they reach the database, with cryptographic separation per source. Production start fails closed rather than use a key ring that could leave credentials unrecoverable.
Governance-critical changes are written to an append-only, hash-chained record. The chain can be verified on demand and reports the sequence where a break is detected.
No knowledge reaches a published state without cited, hash-verified evidence and a named reviewer’s decision. The deterministic grounding checks sit on one release path.
Software deployment and configuration, governed knowledge workflow, product updates, standard support and the evidence/usage record described in the signed scope.
Cloud or host infrastructure, source-data access, network and security approvals, source-data quality, named reviewers and consequential business decisions.
These are self-run engineering checks, not independent certification or assurance.
In a 1,973-test run. Five Docker-dependent fixture tests failed because the container runtime was unhealthy; three were skipped. No non-Docker test failed.
Across grounding, access control, tenancy, approvals, connectors and the API surface. All 23 remediation tasks were merged to main.
Including concurrent drift alerts, a governed proposal lifecycle and an adversarial prompt-injection round. This is functional evidence, not a customer-scale load benchmark.
No external security audit, customer-scale load test or disaster-recovery restore test has been completed. Those requirements are scoped transparently with each customer.
Company Brain can provide deployment scope, data-flow discussion, support targets and implementation boundaries for your assessment. Audit records are tamper-evident rather than immutable; prompt-injection screening is defence in depth rather than a complete trust boundary; and premium hosted-model use sends prompts to that provider. Contracted service levels, premium support, additional regions and bespoke security commitments are separately scoped.
Review the pilot evidence plan →Email security@companybrain.work with enough detail to reproduce the issue. We will acknowledge the report, work the issue and let you know when it is resolved.
Please give us a reasonable opportunity to fix an issue before public disclosure. Do not access, modify or delete data that is not yours; do not degrade service for others; and do not run automated scans against a customer environment.
Company Brain does not currently run a paid bug-bounty programme. Reporters who ask to be credited will be credited.