Security
Commitments you can check
What our infrastructure guarantees
Checkable in our code and our hosting
Hosted in Frankfurt
Data is hosted in Frankfurt, in the European Union. Pages are computed in Frankfurt; public files go through a global network.Isolation by the database
Each company is isolated by the database itself. Automated tests check it on every change of the code.Two-factor authentication
Mandatory for owners and administrators, with single-use recovery codes.Limited attempts
Sign-in attempts are limited, per account and per network address.Log and alerts
Sign-ins, exports and changes of rights are written to the log. A sign-in from a new device or a new country triggers an e-mail alert.Strict headers, separated cookies
A strict content security policy on every page, and sign-in cookies limited to the service's own address, never shared with this site.
How we work
Our commitments when we work on your tools
These commitments cover the way we work. They come on top of the protections of our infrastructure, described above.
What we commit to
- 1
A processing agreement before any access
Before accessing any data, we sign a data processing agreement with you (GDPR, article 28).
- 2
Reading first
We start with read access. Any write access is requested separately, for a specific use.
- 3
Every action approved by you
What the AI prepares is shown to you before it goes out. Nothing is sent, paid or deleted without the approval of a person on your team.
- 4
Our access removed at the end
At the end of our work together, we remove our access to your tools.
- 5
Your data stays yours
You keep your data and can take it back. We only use it for the work you entrust to us.
This site's diagnostic: an exception, stated clearly
To write the scenarios of your report, your answers to the form are sent to an AI model from Anthropic, outside the European Union (United States). Your first name, your company and your e-mail address are never sent to it; avoid writing personal information in the free answers. Anthropic keeps these answers for up to 30 days, longer for content flagged under its usage policies. Your answers and your contact details also reach our mailbox (Google Workspace); if you show the calendar, which loads only after a click, and book a call, iClosed receives what you enter. The e-mails sent to the address entered repeat nothing written in the form. The score, the map and the estimate are calculated by fixed rules, without AI.
See the details in the privacy policyReport a vulnerability
Found a vulnerability?
- Describe what you observed and how to reproduce it.
- Please do not make the vulnerability public before it is fixed.
- We answer you from the same address.
Your questions about security
Do you have a security certification?
Not to date. We prefer to state commitments you can check: the ones on this page. We will only announce a certification once it is obtained.Where is our data hosted?
In Frankfurt, in the European Union, with Supabase. Pages are computed in Frankfurt by Vercel; public files go through its global network. The subprocessors registry details each provider.Can the AI show a colleague what they should not see?
No. We build every central brain so that its answers are limited to what the person asking is allowed to see in your tools.What happens at the end of our work together?
We remove our access to your tools, and you keep your data. The data processing agreement will set this out.How do I report a vulnerability?
Write to security@centralbrain.ai, describing what you observed.
A central brain, with no compromise on security
A central brain is one place linked to all your tools, which answers you and cites its sources. The diagnostic shows you what it would change for you.