Skip to content
Brief Insights

How client documents are protected.

The processing path was designed from the start around German and church data protection law and the professional secrecy lawyers owe their clients.

What happens to a document.

Each document passes through four stages. The last one is deletion.

  1. 1. Received

    The upload travels over TLS 1.3 into EU infrastructure and is held encrypted at rest with AES-256.

  2. 2. Processed

    Classification and extraction run inside the EU. No document is used to train a model.

  3. 3. Returned

    The structured case goes to your case-management system. Your organisation holds the record.

  4. 4. Deleted

    The source document is permanently deleted immediately after processing. Nothing is stored or indexed.

What we commit to in writing.

Each one is documented for your data protection officer.

GDPR

Article 28 processing

A full data processing agreement (DPA) is available on request. Client data is processed in full compliance with EU GDPR.

Residency

Hosted in the EU

All processing runs on AWS infrastructure within the EU. No client document leaves the EU.

Retention

Zero data retention

Documents are permanently deleted immediately after processing. Nothing is stored, indexed or used for training.

Church law

KDG and DSG-EKD

Compliant with Catholic (KDG) and Protestant (DSG-EKD) data protection law, for Caritas, Diakonie and AWO centres.

Encryption

Encrypted, on audited infrastructure

TLS 1.3 in transit and AES-256 at rest, on enterprise AI infrastructure with full auditability and a 99.9% uptime service level agreement (SLA).

Secrecy

Professional secrecy

For law firms, Brief Insights signs a confidentiality agreement under section 43e of the Federal Lawyers' Act (BRAO), covering the duty of secrecy in section 203 of the Criminal Code (StGB).

Questions data protection officers and law firms ask.

Inside the EU, on AWS infrastructure, for the duration of processing only. The extracted case is returned to your system and the source document is deleted. Nothing is kept afterwards.

No. Client data never trains AI models. Documents are processed, returned as a structured case and permanently deleted.

Yes. A full data processing agreement under GDPR Article 28 is available on request. Ask for it in your demo request.

Yes. For law firms, Brief Insights signs a confidentiality agreement under section 43e of the Federal Lawyers' Act (BRAO), which obliges it to secrecy and sets out the criminal liability under section 203 of the Criminal Code (StGB). It comes in addition to the data processing agreement under GDPR Article 28.

Yes. BriefXtract is compliant with Catholic (KDG) and Protestant (DSG-EKD) data protection law, and was built for Caritas, Diakonie and AWO centres.

All processing runs on AWS infrastructure within the EU, including the AI models, which run on Amazon Bedrock.

Send it to your data protection officer.

The data processing agreement, and the confidentiality agreement under § 43e BRAO for law firms, are available on request. Ask in your demo request.

See the platform