Your data, protected
Brain & Arms reads your inbox so you don't have to. Here is exactly what that means for your data — in plain words, no legal fog.
The questions everyone asks
“Wait — you read my emails?!”
Yes — of course. It couldn't sort your inbox or draft your replies otherwise, exactly like an assistant you'd hire. What matters is what that access allows: the AI sees only the sender, the subject and a short excerpt — never your attachments, never your whole archive — and your emails are never used to train AI models.
“So it could send something in my name?”
No. The AI can only read and propose. Every draft waits for you, and nothing leaves without your tap on Send — that's how the system is built, not just a promise. Every send is listed in your activity feed.
“And if I want to stop?”
You hold the switch. You grant the mailbox access yourself, through Google's own consent screen, and you can cut it at any moment in one click from your Google account — without asking us. Your Google password never reaches us. And the day you leave, we delete your instance, your knowledge base and your data, completely.
Your emails stay yours
Your mailbox is read by our own system, on servers we operate in the European Union. When the AI triages a message, it sees only what it needs: the sender, the subject and a short excerpt — never your attachments, never your whole archive. Your emails are never used to train AI models.
Nothing goes out without you
The AI cannot send email — it can only prepare drafts. Every message leaves the same way it does in Gmail: because you pressed Send. Your approval is the only send button in the entire system, and every send is recorded in your activity feed.
Your AI, your account
Your assistant runs on the AI engine you choose — your own subscription, or a private business API with contractual zero data retention. Its credentials live inside your own isolated instance, unreachable from anyone else's.
One sealed environment per client
Every client gets a dedicated instance: their own assistant, their own knowledge base, their own credentials. There is no shared pool of everyone's emails — your environment is yours alone.
How we work
We apply the security practices that SOC 2 audits verify, and we put them in writing:
- Least-privilege access — one named operator, key-based access, no shared logins.
- Encryption in transit everywhere; secrets never live in code.
- An audit trail: every action your assistant takes is visible to you in the app.
- A signed data-processing agreement (DPA) for every client, on request.
- You can leave any time: on request we delete your instance, your knowledge base and your data — completely.
Who else touches your data
A short list, on purpose: Hetzner (servers in Germany, ISO 27001 certified), Cloudflare (network security), Pipedream (Gmail connection, SOC 2 certified — your Google password never reaches us), and the AI engine you chose. No one else.