Security & Privacy

Onbrief stores what your agency and your clients put into it: workspace and client space names, the updates you publish, the files you upload, the approvals you raise and the answers to them, and the activity log that records all of the above.

For people, we store a name, an email address, a role, and the record of what that person did inside the workspace. We do not ask for a postal address, a phone number or a date of birth, and there is nowhere to enter one.

For billing we store the workspace's plan, its seat count, its invoice history and the last four digits of the card. The card number itself is never stored by Onbrief — it is held by our payment processor, and we hold a reference to it rather than the number.

We do not sell any of this, and we do not use the contents of a workspace to train anything.

Everything travels over TLS 1.2 or better. A browser that cannot negotiate that will not connect at all rather than falling back to something weaker.

Stored data — including every file uploaded to a client space — is encrypted at rest with AES-256. Backups are encrypted with the same standard and are kept for thirty days.

Encryption keys are rotated on a schedule and are held separately from the data they protect, so possession of one is not possession of the other.

Access inside a workspace follows the role a person has: owners see everything in the workspace, managers see the client spaces they create or are added to, members see the client spaces they are added to, and guests see only the space they were invited to.

There is no role that lets one client see another client's space, and there is no way to grant one by mistake — a guest invitation is always to a single space.

Inside Onbrief, staff access to a workspace's contents is not granted by default. It is granted one workspace at a time, for a stated reason, with the agreement of a workspace owner, and it expires on its own. Every such grant is recorded, and the record is kept whether or not the access was used.

Owners can see their workspace's own activity log at any time, per client space, under Activity.

While a workspace is open, nothing is deleted unless someone deletes it. Deleting a client space removes its updates, files, approvals and activity log; archiving keeps all of them and hides the space from the lists.

When a workspace is closed, its contents move into a thirty-day window during which a workspace owner can ask for the whole workspace to be restored, exactly as it was. Sign-in stops immediately at closure; the window exists for the agency that changes its mind, not for continued use.

After thirty days the contents are erased, and that is not reversible. Backups made before the closure age out within the following thirty days, so sixty days after a workspace closes there is nothing of it left anywhere.

A workspace owner can ask for erasure sooner than thirty days, in writing, and we will confirm in writing when it is done. Two things survive erasure because the law requires it: the invoice record, and the fact that a workspace of that name existed and when it closed.

Onbrief uses a small number of other companies to run the product, and each of them sees only what its job requires:

• A payment processor, which holds card details and raises the charges. It sees billing data and never sees the contents of a workspace.
• An email provider, which sends invitations, notifications and invoices. It sees names, email addresses and the text of those messages.
• An error-reporting service, which records what went wrong when something breaks. It is configured not to receive the contents of updates, files or approvals.

The current list, with each company's name and role, is available from support on request, and we tell workspace owners by email before a new one is added.