Security, privacy, reliability and autonomy boundaries belong in one evidence-led public surface—not scattered claims.
This public trust center shows current control boundaries and intentionally does not claim certifications THE BRAIN has not independently obtained.
Identity, least privilege, encrypted transport/storage, protected environments and audited sensitive actions.
What is collected, why, where it flows, retention choices, rights and provider boundaries.
Status, incident communication, recovery paths and service-component transparency.
THE BRAIN acts inside explicit authority, policy, rights and spend limits.
Formal compliance/security claims only become active when there is current evidence with scope and validity. Provider attestations are not automatically THE BRAIN attestations.
No THE BRAIN SOC 2 certification is claimed. Evidence will be linked only after a valid independent attestation exists.
Provider compliance documents may inform shared responsibility, but their certification scope remains the provider's.
Release, auth, provider and operational controls can link to THE BRAIN's own sealed proof where appropriate.
Trust information distinguishes platform responsibility, customer account responsibility, third-party channel responsibility and connected-provider responsibility.
Security reports submitted through Contact are persisted with the security route. Do not include passwords, API keys or other secret material in the initial report.
Open security contact