Brigade

Last updated October 28, 2026

Privacy policy

Brigade gives your company AI teammates. This page explains what we store to run it, and what we don't do with it.

Who we are

We are the controller of your account data and of the data we need to run and bill the service. For what you and your teammates put in a workspace, we act on your company's behalf, as a processor: our data processing agreement covers it.

What we store

  • Your account: your name, email address and profile picture, from the sign-up form or from Google when you sign in with Google.
  • Your workspace: threads, messages, files you attach, library documents, tasks, skills, schedules and the settings of your teammates.
  • Apps and secrets: the accounts you connect (such as GitHub or Gmail) and the credentials you save to the vault. Secrets are stored encrypted, and nobody, teammates included, can read them back.
  • Your devices: the computers you link to Brigade, and a push subscription when you turn on notifications.
  • Sign-in and security: the IP address and browser of each session, the codes we email you to sign in (they expire within minutes), and counts of recent attempts, to stop abuse.
  • Email: mail your teammates send and receive at their Brigade addresses.
  • Cloud computer: what your teammates keep on it, and an encrypted copy of its Claude or Codex sign-in, so a new machine can take over when we replace it.
  • Billing: your plan, invoices and the email of who pays. Stripe keeps the card details.
  • Usage: where you came from when you signed up (such as the site that linked to us, or a campaign's name in the link), and which features you use and when. Never the content of your workspace or your email address.

We set only the cookies Brigade needs to work, such as the one that keeps you signed in. We don't use advertising or tracking cookies.

We use PostHog, in the EU, to measure visits and how Brigade is used. On this website it runs without cookies or any storage in your browser, and it doesn't record your screen. From Brigade itself we send it only pseudonymous ids, counts and the kind of each action (such as “a thread started”), never your content, names or email address. When Brigade hits an error, we also send it the error's message, with email addresses and links removed, and the place in Brigade's code where it happened, so we can fix it.

How we use it

Only to run Brigade for you: show your workspace, let your teammates do the work you ask for, and send the notifications you chose. We don't sell your data, show ads, or use your content to train AI models.

We do this to perform our contract with you (running your account and workspace, billing), for our legitimate interest in keeping Brigade secure and preventing abuse and in measuring how people find and use Brigade to improve it, to meet legal obligations (such as keeping invoices), and with your consent where we ask for it (such as notifications).

AI models

Your teammates run on your own Claude or Codex subscription, on your computer or on Brigade's cloud computer. What they read and write is sent to Anthropic or OpenAI under your account with them, and their own privacy policy applies: they are your providers, not ours.

Data from Google

When you connect a Google App, Brigade asks only for the access that App needs, and uses it only for the work you or your teammates ask for:

  • Google Docs and Google Sheets: to read, edit and create the documents and spreadsheets you give a teammate, by link or because it made them.
  • Google Analytics and Search Console: to read the reports of the properties and sites you connect.
  • Gmail, Google Calendar and Google Drive: to read, send and organize the mail, events and files of the account you connect, as you ask.

Your Google sign-in tokens are kept encrypted in the vault. What a teammate reads or writes with them is kept in the thread where it did the work, until you delete that thread, and is sent to your Claude or Codex subscription only to do that work. We don't use data from Google for ads, sell it, use it to train AI models, or let anyone read it, except when you ask us to for support, for security, or when the law requires it.

Brigade's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Brigade does not use Google Workspace data obtained through Google APIs to develop, improve or train generalized AI or machine learning models.

Who we share it with

We share your data only with the services that run Brigade for us, and only what each needs:

  • Cloudflare: runs Brigade, keeps your files (Cloudflare R2) and checks sign-ups for bots.
  • Neon: hosts Brigade's database, in the EU (Frankfurt).
  • Boat: runs the cloud computer your teammates work on, in the EU, when your workspace has one.
  • Resend: sends and receives Brigade's email, such as sign-in codes and your teammates' mail.
  • Stripe: handles payments. We never see your card number.
  • PostHog: measures visits and feature usage, in the EU, without your content or email address, and collects reports of the errors Brigade hits.
  • Google: when you sign in with Google or connect a Google App.
  • GitHub: when you connect your repositories.
  • Your browser's push service (Apple, Google or Mozilla): the notifications you turned on.

The list of subprocessors says where each one is and what it does. Some of them are in the United States: transfers there rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. We don't sell your data or share it with anyone else, unless the law requires it.

How we protect it

  • All traffic to and from Brigade is encrypted (HTTPS).
  • Secrets and App tokens are encrypted in the vault with a key kept apart from the database, and nobody, teammates included, can read them back.
  • Each workspace's data is kept apart from the others, and only its members and the teammates they allow can reach it.
  • Only the people who run Brigade can reach its systems, for operations and support.

Keeping and deleting it

We keep your data while your account exists. You can disconnect an App, delete a secret or a thread at any time from the dashboard: disconnecting a Google App also revokes Brigade's access in your Google account, and deleting a thread deletes its files. You can also remove Brigade's access at any time from your Google account.

An owner can delete a workspace, and you can delete your account, in Settings. Deleting a workspace deletes its threads, files, library, teammates and Apps, and destroys its cloud computer; deleting your account deletes your profile and the threads you started. Files go from storage within hours. Copies in our database backups expire within 30 days. We keep invoices for 10 years, as French law requires, and a short record that the workspace was deleted and by whom.

Your rights

You can ask us to access, correct, delete or export your personal data, to restrict how we use it, or object to it, by emailing support@brigade.lol. We answer within a month. If your data is in a workspace someone else's company runs, we may pass your request on to them. You can also complain to the French data protection authority, the CNIL, or the one where you live.

Contact

For any question about your data, email support@brigade.lol.

Changes

If this policy changes, we update this page and the date at the top of it.