trust · data handling

Where your work lives, and for how long.

Specific answers: where your data is stored, in what region, encrypted how, with what retention, and who processes it on our behalf. Under the covers, but not under wraps.

us-east-1EU residency: queued

primary region

us-east-1 (Iad-1). No cross-border replication of raw user data.

7d + 30d

backup retention

Point-in-time 7d + daily snapshots 30d. Age out on delete.

AES-256

encryption at rest

Disk-level via Supabase. TLS 1.3 in transit everywhere.

the specifics

Nine facts about where your data lives.

Not a marketing page. Just the specific answers you’d want if you were a security or compliance reviewer walking through the vendor questionnaire.

Primary storage: Supabase Postgres, dedicated project · us-east-1 (Iad-1)
Encryption in transit: TLS 1.3 everywhere · HSTS with preload · 2y max-age
Encryption at rest: AES-256 disk-level via Supabase
Backups: Point-in-time recovery, 7-day retention · daily snapshots, 30-day retention
Object storage: Supabase Storage (S3-compatible) for uploaded class materials only
Compute: Vercel Edge Functions (Iad-1 primary) · autoscaling · zero cold start on frequently-hit routes
Rate limiting: Upstash Redis · per-user token bucket · burst-tolerant, abuse-resistant
Analytics: PostHog Cloud (US region) · first-party, opt-out honored · no third-party trackers
Error tracking: Sentry · PII scrubbed at capture time · 30-day retention

retention windows

How long every data type actually lives.

Retention is a policy question dressed as a technical one. Here’s ours — every data type, its lifetime, and what triggers deletion.

data type	lifetime
Account (email, name)	Life of account + 30 days after deletion
Session transcripts	Until you delete them or the account (soft 30d, hard delete)
Explain-back submissions	Same as session transcripts
Recall cards	Same as sessions (they reference the source session)
Brain scores + trends	Life of account; recomputable from raw
Uploaded class materials (PDFs)	Until you delete them or the account
Payment history	7 years for tax; PII-minimized after 90 days (Stripe handles)
Analytics events	12 months in PostHog; aggregate-only after
Error logs	30 days in Sentry; auto-purged
Audit logs	18 months in Supabase; immutable

residency

Where your data doesn’t go.

data residency policy

policy

# Data residency

- Primary DB, storage, compute, analytics: all US (us-east-1 / iad).
- No cross-border replication of raw user data.
- Anthropic API calls: routed to Anthropic's global inference. Anthropic does
  not train on API traffic. We hold no zero-retention agreement, so limited
  retention for trust and safety applies under their standard terms.
- EU/UK users: data is stored in the US under SCCs (Standard Contractual
  Clauses). EU data-residency (Frankfurt) planned Q2 for institutional
  customers who require it.

EU / UK note

Today: US storage under SCCs. An EU-region option (Frankfurt) for institutional customers with hard residency requirements is queued and undated. If you’re a school in the EU/UK evaluating for a pilot, tell us — that is the thing most likely to move it up the list.

Portability

Everything is exportable. Settings → Privacy → Export. JSON, one file per top-level table. If you leave Brainback, you leave with your work. This is written into the DPA and the account-deletion flow.

Deletion, per data type

Session transcripts: individually deletable from the session page, or in bulk from Settings → Privacy → Sessions. Cards: bulk-delete per subject or account-wide. Uploaded materials (PDFs): individually removable from Settings → Materials. Account-level delete cascades to everything with your account_id.

Subprocessor changes

We commit to a 30-day notice before adding a new subprocessor that processes user data. Institutional customers can subscribe to the subprocessor changelog via email; individual users can watch the subprocessors page where changes are dated.

fair questions

What a DPO or compliance reviewer will want to know.

Where is my data stored?▾

Primary in Supabase’s us-east-1 region (Ashburn, Virginia, US). Vercel edge is global but session data is us-east-1. No cross-border replication of raw content.

Do you back up my data?▾

The database is backed up by Supabase under their managed backup regime for our plan; neither snapshots nor any point-in-time copy are user-accessible, and both exist for infrastructure recovery only. We are not going to quote you a specific recovery window on this page until a restore has been tested rather than assumed — if that detail is part of your procurement review, ask and we will give you the current plan and what it includes. On account deletion, hard-delete from the live database is immediate at day 30 and backup copies age out with the retention window.

How does Anthropic handle my data?▾

Anthropic does not train on what passes through the API — that is their published default for API traffic, not a special arrangement we negotiated. What we do not have is a zero-retention agreement: like any standard API customer, inputs and outputs may be retained by Anthropic for a limited period for trust-and-safety purposes under their commercial terms. If your procurement requires zero retention, say so — it is an arrangement that has to be applied for, and we would rather tell you that now than discover it at signature.

What about EU / UK data residency?▾

Currently stored in the US under Standard Contractual Clauses. An EU-region option (Frankfurt) is on the roadmap as queued — not started, and with no date attached, because a date we have already missed once is worth less than none. If your school requires EU residency for procurement, contact sales@brainback.chat and we will tell you honestly where it sits.

Can I export everything and delete forever?▾

Yes. Settings → Privacy → Export (JSON) then Settings → Privacy → Delete Account. Export is complete before delete finalizes so you have your data. Full DSAR support for non-account holders via privacy@brainback.chat.

Do you have a Data Processing Addendum?▾

Yes — it is published in full at /legal/dpa so your counsel can read it before contacting us. It is a draft pending our own counsel review, which the document states on its face, and it is not pre-signed. GDPR, PIPEDA and FERPA aware; school-specific addenda and redlines welcome.

Who processes my data on your behalf?▾

Full list at /legal/subprocessors. Short version: Anthropic (AI inference), Stripe (billing), Supabase (auth+DB+storage), Vercel (compute), Upstash (rate-limit), PostHog (analytics), Resend (email). All under written DPAs.

vendor questionnaire? start here — this page is written against the standard ones

→trust · data

Ask the specific question.

privacy@brainback.chat · /legal/dpa · /legal/subprocessors.