Security
Last updated 2 September 2026
How Brief is run, for people who want to know before they trust it with a rehearsal.
Where things live
The application runs on Vercel. The database is Neon Postgres, reached over TLS. Files (photos we re-host, voice takes when kept) live in Vercel Blob. Secrets are environment variables, never in the code.
Sessions and cookies
Sign-in sessions and the anonymous ownership cookie are HTTP-only and sent only over HTTPS in production. Nothing client-side reads them. Share links and invite links are long random codes; a share link can be turned off by its owner at any time.
Voice and conversation
Conversations run on ElevenLabs. The browser receives a short-lived token for one conversation, never our API key. Cloned voices exist only where the person recorded or supplied them, or privately for whoever made them from clips.
Reporting a problem
Found something? Write to hello@withbrief.ai and we will answer.
Questions, corrections or removal requests: hello@withbrief.ai, or use the removal and correction form.