Your client data stays in a private environment for your firm on AWS. The AI models that read it run on zero-retention terms and never train on it. Nothing goes into Salesforce until an advisor approves it. Briefly makes suggestions for the advisor to review, and the advisor makes every decision and every recommendation.
Where your client data lives
Your firm's data lives in an environment we secure and control, hosted on AWS with access scoped to your firm.
A private environment for your firm
Your client data stays in a private environment for your firm on AWS. Access is scoped to your firm's account.
Your firm decides who signs in
Staff sign in through Amazon Cognito. Every session ties back to an individual login and your firm's account, and your firm decides who gets one.
Every line links to its source
Briefly keeps a current picture of each client, and every line links back to its source, so an advisor can check any statement before using it.
What reaches the AI models
A careful vendor review should ask about the model providers too. Here is the data path.
Briefly sends client data to a model only to answer a question or write a report. Every one of those calls runs on zero-retention terms, and the model providers never train on it.
Every web app model call that carries client data asks for zero-data-retention endpoints only. Extraction has a fallback model on the same terms, so an outage at one provider does not push documents onto endpoints that keep data. A model missing from the zero-retention list is skipped.
One more fact a thorough vendor review will surface. No tool built on a frontier model can honestly promise that nothing is ever retained. The useful questions for any vendor are where data is stored, which terms govern each model call, and what the vendor itself holds.
What Briefly learns, and what it does not
We don't use client data to train AI models. Any pattern-level learning, such as how your firm likes its work done, runs through a de-identified, tokenized layer with no client name or account number attached.
The advisor approves before anything is written
When a task is created from chat, it waits in Action items until an advisor approves it. Nothing goes into Salesforce before that. The assistant saves an advisor preference only when the advisor asks it to, and it can only run briefs for clients the advisor has access to.
Briefly makes suggestions for the advisor to review. The advisor makes every decision and every recommendation.
If your firm leaves
Your firm has ninety days after leaving to export its files in a standard format, and after that window we delete them.
Two ways advisors use AI on client data
The difference shows up in whose terms govern the data.
Pasting client details into a personal AI chat window sends them to the vendor's servers under consumer terms your firm never reviewed.
Your firm signs in through a browser, and client data stays in a private environment for your firm on AWS. Model calls run on zero-retention terms, so your firm has one vendor to review.
What this means under Reg S-P
SEC privacy and safeguards rules, Reg S-P among them, put the duty on advisory firms to know how their vendors handle customer information, and firms are treating AI tools as part of that vendor review. That oversight duty sits with your firm as well as with us.
Both the SEC and FINRA have said publicly that they are watching how firms use and supervise AI. In practice, regulators look at the vendor relationship as well as the advisor's own desk.
Because Briefly holds your firm's data, the review takes in our AWS hosting, per-firm access controls, and the terms that govern each model call. No agency certifies an AI tool as SEC-approved. That label doesn't exist. What a firm can document is how a specific tool actually handles client data, which is what this page lays out.
How we secure the account layer
Sign-in
Access runs through Amazon Cognito, the identity system a large share of the software industry runs on. Every session ties back to your individual login and your firm's account.
Per-firm isolation
Per-firm access controls scope each firm to its own data. Sign-in and preference records are isolated at the application level for every firm.
Encrypted transport and vendor review
Traffic between your computer and our servers runs over encrypted connections. We review the vendors behind that layer, including AWS and Cognito, the way we'd want a vendor we depend on reviewed.
Security work in September 2026
We reviewed the web app's code in September and shipped the changes below.
Uploads are checked before anything reads them
Each upload is signed for its exact size and capped at 50 MB, and only PDF, Word, image, text, and email files are accepted. A file over the limit is deleted before the app opens it.
Connected inboxes stay inside your firm
Briefly checks each mailbox with the email provider before saving the connection. It accepts your own address or a colleague’s on your firm’s domain, and refuses a mailbox on another domain or one that another firm has already connected.
Firmer request limits and cleaner error reports
Request limits now key on the address our load balancer sees, which a caller cannot fake. Error reports drop request bodies, cookies, and sign-in headers before they leave the server, and the admin console no longer accepts access tokens in web addresses.
Dependencies brought up to date
We updated the libraries behind the API, the web app, and the connector server. A production audit now shows no critical or high-severity known vulnerabilities in any of them. A few low and moderate findings remain on our list.
Compliance officer FAQ
The questions we hear most from the people responsible for signing off on a vendor like Briefly.
Where does client data live?
Your client data stays in a private environment for your firm on AWS, with access scoped to your firm's account. Your firm decides who signs in.
What reaches the AI models?
Briefly sends client data to a model only to answer a question or write a report. Every one of those calls runs on zero-retention terms, and the model providers never train on it.
Does Briefly train AI models on client data?
No. Client data is used to run the product for your firm. Any pattern-level learning runs through a de-identified, tokenized layer with no client name or account number attached.
Can Briefly write to Salesforce on its own?
No. Nothing goes into Salesforce until an advisor approves it. Briefly makes suggestions for the advisor to review, and the advisor makes every decision and every recommendation.
What happens to our data if we leave?
Your firm has ninety days after leaving to export its files in a standard format, and after that window we delete them.
What happens if Briefly's servers are breached?
Briefly's hosted environment holds your firm's data, so we protect it with encryption and per-firm access controls that scope each firm to its own data. Sign-in and preference records are isolated at the application level for every firm.
How does this change our Reg S-P vendor due diligence?
Firms generally review Briefly as a service provider under Reg S-P, the same as any vendor. Because Briefly holds your firm's data, the review takes in our AWS hosting, per-firm access controls, and the terms that govern each model call.
Is Briefly SEC-approved or certified compliant?
No certification like that exists, and no agency approves an AI tool as compliant. What we can show you is exactly how Briefly handles client data, which is the purpose of this page.
Does Briefly also come as a Claude connector?
Yes. Briefly also comes as a connector for Claude Desktop, priced separately from the web app. On the connector, client files stay in a folder on the advisor's computer. The last section of this page covers what reaches Briefly's server and what Anthropic does with it.
For firms that use the Claude connector
Briefly also comes as a connector for Claude Desktop, priced and sold separately from the web app. On the connector, client files stay in a folder on the advisor's computer that Briefly reads from and writes back to, and there is no upload step.
Briefly's server receives sign-in through Amazon Cognito, a seat-active check, de-identified preference rules, and a short usage record for each tool call. None of it carries client file content.
When an advisor asks a question, Claude reads what it needs from the folder, and Anthropic processes that content under the firm's own Claude agreement. On Claude for Work, Claude Enterprise, and the API, Anthropic's commercial terms prohibit training on customer content. Deleted conversations purge within 30 days, except content flagged by Anthropic's safety systems. Since June 2026, even Anthropic's zero-retention API arrangements carry a 30-day retention window on its newest models for safety monitoring. We recommend firms run the connector on a business Claude plan.