Security and data handling
What we read, what we keep, and what we do not have yet.
Every statement on this page names the code that enforces it. The last section is what procurement asks for first, stated as of 23 September 2026 and changed the day it changes.
What do you read?
- What is read
The curated library is public feeds only: RSS and podcast feeds, published captions, changelogs and release notes, and regulator feeds such as Federal Register notices and agency press releases. Nothing in it is behind a paywall or a login. On plans that take your own URLs, a username and password written before the host (user:pass@) are removed or refused; a token anywhere else in the address is kept as written, and Briefwire cannot tell whether a feed you add is public, so what you add is your call — Terms s4 permits only sources you are entitled to have monitored. Briefwire never asks for your own documents, mail or CRM.
- URLs you give us
A source URL you paste is fetched through a guarded client that resolves the host once, refuses private and link-local addresses, caps the response in bytes while streaming and follows redirects only to addresses that pass the same checks.
What do you keep, and for how long?
- What is kept, and for how long
The raw transcript of a source is processed and deleted after 7 days. What stays is the line itself: a paraphrase of at most two sentences, its type, its sources and the link back to where it was said — and, for each promise in the commitment ledger, dated or not, the speaker's exact words (at most 600 characters). Briefwire never downloads or stores audio or video itself. When a podcast publishes no transcript, the episode is not read: its audio is not transcribed, and its address is sent to no one.
Who can see my account?
- Your account
Sign-in happens through your email, with a one-time link; we never ask for a password. Payment details are held by the billing processor and never reach Briefwire. Everything in the account exports as CSV or JSON, and the account can be deleted, from Settings → Data.
- API keys
Keys are shown once at creation and stored only as a SHA-256 hash; a key is read-only and sees only the watchlists the account owns.
- Webhooks
Every delivery carries an
X-Briefwire-Signatureheader — a timestamp and an HMAC-SHA256 over the timestamp and the raw body, keyed with the endpoint’s secret — so a receiver can reject anything not sent by us.
Show where each statement is enforced
- What is readsrc/lib/sources
- What is kept, and for how longTRANSCRIPT_RETENTION_DAYS in src/lib/config.ts; the cleanup cron; configuredAudioAsrProviders() in src/lib/transcripts
- Your accountsupabase.auth.signInWithOtp; src/app/auth/confirm/verify/route.ts; src/components/data-panel.tsx
- API keyshashApiKey() in src/lib/api-keys.ts
- Webhookssrc/lib/webhooks/signature.ts
- URLs you give ussrc/lib/sources/safe-fetch.ts
Who else touches the data?
- Vercelhosting, the scheduled jobs and Vercel Web Analytics (aggregate page views)
- Cloudflarethe CDN in front of the site; it adds its own aggregate page-view counter, and routes mail sent to our addresses
- Google (Gmail)the mailbox that mail sent to our addresses is forwarded to
- Supabasethe Postgres database and sign-in, in the US (us-east-1)
- Polarbilling; card data never touches Briefwire
- Resendthe digest and alert emails, sent from its Tokyo, Japan region
- Supadata, Apify and TranscriptAPIpublished YouTube captions, in that order of preference; each receives only a public video identifier
- OpenAI, Anthropic or Googleextracting lines from transcript text, whichever one is configured; only the text is sent
The privacy policy carries the same list with the legal basis for each.
What don’t you have yet?
- No SOC 2 report. None is in progress at the time of writing; this line changes when one is.
- No SSO or SAML. Sign-in is by email only.
- No data-residency choice: the database is hosted by Supabase in one region.
- No sources in any language but English; no regional editions.
- No accuracy figure. No week has been scored against a labelled set yet; the number appears here the day one has been.
- No pay-by-invoice or purchase-order option at checkout, which takes a card. If your procurement needs either, email support@getbriefwire.com before you buy.
- Regulatory sources and hiring signals, which Intelligence Partner includes, are not live yet. The regulator feeds in the curated library, such as Federal Register notices, are read today.
Briefwire is built and run by its founder, Edward Chew, from Kuala Lumpur; there is no support team between you and the person who wrote the code, which is why the addresses below are answered by him.
Security questionnaires: support@getbriefwire.com. Data-processing agreements: legal@getbriefwire.com. Anything else: support@getbriefwire.com.