Your data stays yours.
Always.
Per-account isolation enforced by the database. Documents and vectors on our own hardware in Brazil. The one step that leaves the country is answer generation, and it is declared by name in the DPA.
Postgres RLS
Row-Level Security active. Engine runs as role valorbrain_app with tenant-scoped policies enforced by the database. BYPASSRLS isolation for admin migrations.
Token hashing
MCP tokens stored as SHA-256 hash. Raw token shown only once at creation. Granular per-token scopes.
Daily backup
Postgres dump every day, kept 14 days, inside the same physical perimeter as the database. Restore already exercised in a real incident. TLS 1.3 required for all traffic.
On-premise
Optional on the Empresa plan, included on Enterprise: all of ValorBrain on your infrastructure, answer model included. No step leaves your perimeter.
LGPD
We are the processor; you are the controller. Designated DPO, public DPA, open subprocessor list. Access, correction, deletion and portability through the product.
Access record
Who searched, who opened which document and when, with user_id and timestamp. Available while the account exists, exportable at any time.
Deletion
A deletion request erases content and vectors within 30 days. Backups rotate every 14 days, so no copy survives beyond that.
Where the data sits
Documents, vectors and database on our hardware in Santa Catarina, Brazil. Embedding, rerank and NER on the same machine's GPU. The exception is answer generation, which uses a cloud LLM abroad — declared in the DPA.
Incident transparency
3 incidents (TRUNCATE-prod) handled within 24h in May 2026. 4-layer defense active since. Public postmortem available under NDA.
Compliance status
Honest about where we are. No claims without proof.
If your diligence requires a certification today, the honest answer is that we have none. What we do have is the DPA, the subprocessor list, and the willingness to answer a security questionnaire line by line.
How multi-tenant works
1.Tenant ID on every request
Every engine call carries X-Tenant-IDderived from the user's JWT. Engine validates ownership before any query.
2.Postgres RLS policies
Each table with tenant_id has an RLS policy: USING (tenant_id = current_setting('app.tenant_id')). Engine runs as role valorbrain_app which respects RLS.
3.Connection-level isolation
Each connection sets SET LOCAL app.tenant_id = '...' at the start of the transaction. Connection pool does not share state across tenants.
4.Defense in depth
4 layers: app-level filter → engine validation → Postgres RLS → BYPASSRLS guard on admin ops. Documented in SAFETY.md in the repo.
Security questions?
We speak your language. Security questionnaires, architecture detail, NDAs — all available.