Trust
Braize is engineered so that the safe thing is the default thing. Access control, tenant isolation, and inference routing are structural — not policies you have to remember to apply.
Access
Access control is enforced as a pre-filter inside every retrieval SQL leg — dense, lexical, and fallback — never a post-filter. A shared predicate block keeps the legs from drifting, and a dedicated leak suite gates CI.
Content you are not explicitly granted is excluded. Anonymous requests resolve to public scope only; asserting an identity is scope-gated and the principal must exist.
Permissions expand recursively through groups with a depth cap and cycle guard, mirroring the source's own ACLs.
The answer cache is keyed by a principal-scope hash; an ACL or membership change rotates the key so stale answers become unreachable.
Isolation
Each workspace is a separate Postgres database with its own login role and REVOKE CONNECT FROM PUBLIC. Cross-workspace access is structurally impossible, proven against real Postgres.
A workspace is pinned to one region at creation. Services receive a single-workspace-scoped connection; no service can construct a cross-region connection.
Vectors can encode the underlying text, so they never leave the workspace database — not in logs, analytics, or backups — and are nulled on purge.
Boundaries
Ingested content is normalized and scanned for hidden instructions; any match quarantines the whole document — it is never indexed.
Every outbound fetch passes an egress guard that blocks loopback, private ranges, and cloud-metadata, and re-validates each redirect hop.
A per-workspace processing_policy constrains allowed regions, can require zero-data-retention endpoints, or lock inference in-region — enforced in the gateway with no silent fallback.
Lifecycle
Deleting a document removes it from retrieval immediately and enqueues a purge of content, vectors, blobs, and cached answers, targeted within 24 hours. Content-free tombstones preserve audit.
owner / admin / editor / viewer roles are enforced on every API route, with owner-only and last-owner guards.
In line with EU AI Act Article 50, every end-user channel always discloses AI-generated responses — enforced at the channel boundary, not themeable away.
Built for sovereign teams
Hosted in Europe. Each workspace is pinned to one region; embeddings never leave it.
See our full posture — with honest status labels, including what we have not certified yet — in the Trust Center, or reach out to walk through architecture, subprocessors, and data-processing terms.