Security first.

Our stack

Built on trusted providers.

We chose infrastructure partners with strong security track records and compliance certifications, so you benefit from their investments in security.

Service	Certifications	Why we trust them
RailwayPlatform and hosting		Runs every Briefer service in the EU (Amsterdam), with network isolation between projects, KMS-encrypted secrets and annual penetration testing. We get a hardened, audited platform instead of servers we patch ourselves.	Trust page
SupabaseDatabase and auth		Holds the database and files in the EU (Stockholm) and handles sign-in. Every table carries row-level security, so tenant isolation is enforced by the database itself, not just by our application code. AES-256 at rest, TLS 1.3 in transit.	Trust page
CloudflareCDN and edge		Sits in front of Briefer as CDN, DDoS protection and edge cache in the EU. It sees request metadata and IP addresses transiently.	Trust page
ComposioConnectors		Powers the connections to your other systems. Authentication happens with OAuth through Composio's managed token store with granular permission scopes, so Briefer never sees or stores your third-party passwords.	Trust page
ResendEmail delivery		Delivers your investor updates. Mail travels encrypted, every sending domain is set up with DKIM, SPF and DMARC, and Resend backs it with regular third-party audits and a responsible disclosure program.	Trust page
AnthropicAI / LLM		Runs the AI that drafts your updates, under zero data retention. API data is never used to train models: your numbers and your narrative stay yours. Anthropic's safety-first posture is a large part of why we build on Claude.	Trust page
CohereAI / retrieval		Used for one narrow job: search embeddings and reranking, nothing else. Like Anthropic, Cohere runs under zero data retention and never trains on customer data, and everything is encrypted in transit and at rest.	Trust page
ReductoAI / document parsing		Reads the files you upload: text, tables and scanned pages, turned into something the agent can work with. Documents are processed in the EU only, under zero data retention, and are never used to train models.	Trust page
StripePayments		Handles billing. Card numbers go straight to Stripe and never touch our servers, and PCI DSS Level 1 is the highest certification the payment industry issues. The default choice for a reason.	Trust page
MixpanelAnalytics		Shows us which features founders actually use, from usage events with pseudonymous user IDs; no names or email addresses. No investor data leaves the platform for analytics, and GDPR retention and deletion controls apply.	Trust page

• RailwayPlatform and hosting

  Trust page
  

  Runs every Briefer service in the EU (Amsterdam), with network isolation between projects, KMS-encrypted secrets and annual penetration testing. We get a hardened, audited platform instead of servers we patch ourselves.

• SupabaseDatabase and auth

  Trust page
  

  Holds the database and files in the EU (Stockholm) and handles sign-in. Every table carries row-level security, so tenant isolation is enforced by the database itself, not just by our application code. AES-256 at rest, TLS 1.3 in transit.

• CloudflareCDN and edge

  Trust page
  

  Sits in front of Briefer as CDN, DDoS protection and edge cache in the EU. It sees request metadata and IP addresses transiently.

• ComposioConnectors

  Trust page
  

  Powers the connections to your other systems. Authentication happens with OAuth through Composio's managed token store with granular permission scopes, so Briefer never sees or stores your third-party passwords.

• ResendEmail delivery

  Trust page
  

  Delivers your investor updates. Mail travels encrypted, every sending domain is set up with DKIM, SPF and DMARC, and Resend backs it with regular third-party audits and a responsible disclosure program.

• AnthropicAI / LLM

  Trust page
  

  Runs the AI that drafts your updates, under zero data retention. API data is never used to train models: your numbers and your narrative stay yours. Anthropic's safety-first posture is a large part of why we build on Claude.

• CohereAI / retrieval

  Trust page
  

  Used for one narrow job: search embeddings and reranking, nothing else. Like Anthropic, Cohere runs under zero data retention and never trains on customer data, and everything is encrypted in transit and at rest.

• ReductoAI / document parsing

  Trust page
  

  Reads the files you upload: text, tables and scanned pages, turned into something the agent can work with. Documents are processed in the EU only, under zero data retention, and are never used to train models.

• StripePayments

  Trust page
  

  Handles billing. Card numbers go straight to Stripe and never touch our servers, and PCI DSS Level 1 is the highest certification the payment industry issues. The default choice for a reason.

• MixpanelAnalytics

  Trust page
  

  Shows us which features founders actually use, from usage events with pseudonymous user IDs; no names or email addresses. No investor data leaves the platform for analytics, and GDPR retention and deletion controls apply.

We notify customers by email at least 30 days before adding or replacing a sub-processor. Our Data Processing Agreement applies to all customers and is published at briefer.vc/dpa.