Brainstead keeps each agency client's material separate in the infrastructure. Every client brain has its own storage bucket and its own encryption key in AWS Frankfurt (eu-central-1), and credentials for one brain have no permission on another's.
The Slack app, agent container, tool connections and sessions are per brain too, and a brain you don't own returns "not found". It runs on Claude by default, or another frontier model your client chooses. SOC 2 and a DPA are in progress.
Design-partner stage · priced per client brain, not announced
Per brain
Created when you name the client, in AWS Frankfurt (eu-central-1).
One per brain. Tool and Slack tokens are encrypted under it.
Each brain has its own, named after the client.
Read-only filesystem, no privileges, no web browsing.
ClickUp, Notion and others, connected per brain, read-only by default.
A conversation in one brain is never visible to another.
Status
Separate buckets and keys, scoped credentials, per-brain containers and the audit log are enforced in code today. Signed approvals, roles and single sign-on, short-lived cloud credentials and a write-once audit trail are in development. The security page keeps the full list.
Deletion
Copy and paste
How to
Naming a brain, for example harbour, creates its own storage bucket and encryption key in AWS Frankfurt (eu-central-1).
The website (up to 25 pages), brand files and skills are written into that brain's bucket only, as markdown.
Each brain gets a separate Slack app, so a mention in one client's channel can only reach that client's brain.
ClickUp, Notion and other tools connect per brain, read-only by default. Their tokens are encrypted under that brain's key.
Deleting the brain stops its agent, deletes every stored file version, removes its connections and schedules its key for deletion.
Why it matters
In a shared AI workspace, clients are kept apart by folders, project names and people's care. That holds until someone picks the wrong project, a shared connection reaches a tool it shouldn't, or a client asks you to prove the separation in a questionnaire.
Brainstead moves the separation into the infrastructure. A brain is created with its own bucket and key, its credentials are scoped to that client alone, and a request for another client's brain gets "not found". Getting it wrong would take a change to the system, not a slip by a person.
Questions
In AWS Frankfurt (eu-central-1), in a dedicated storage bucket per client, encrypted with that client's own key.
Today, only its owner. Anyone else gets "not found". Roles for the rest of the team are in development.
The agent stops, every stored file version is deleted, connections are removed and the key is scheduled for deletion. Each step is logged.
Not yet. Both are in progress, together with an independent pentest and a subprocessor list.
Brainstead is priced per client brain, not per seat. Pricing isn't announced yet.
It isn't immune to prompt injection. It limits what an agent can reach, and a person reviews everything before it goes out.
Related
Each client brain also works with Slack, Brand voice, ClickUp and ChatGPT projects vs Brainstead. See what runs today and what's in development, the security page for questionnaires, or start from the Brainstead home page.