Your AI cannot do more than you.

A person sees a note if it is theirs, or if somebody shared with them the branch it sits in. This rule does not live only in the interface: it is applied by the database to every ordinary read and write from the site and AIs. The ordinary administration panel does not display note content.

Notes and attachments are also encrypted: how, you will find below. Content access on our side is allowed only for requested support, security or legal obligations and must be restricted to what is strictly necessary.

The practical consequence: a connected AI works with exactly your permissions. It reads what you read, writes where you can write. There is no side door.

The text of notes, of their versions and of the trash is encrypted (AES-256-GCM) with a different key for every brain. Since 10 October 2026 attachments are too: every file has its own key, sealed with the brain’s, including when your AI uploads it or you move it to another brain. The database and the file store hold only encrypted text: the database cannot read your notes, and whoever stores your files cannot open them.

The brain keys are generated and held by AWS KMS, and only Cobrain’s production server can use them: no key is written down anywhere. Every use of a key goes into a log nobody can delete for five years. Search still works, on an index that keeps fingerprints of the words, not the words. On the Pro and Team plans there is also a fingerprint of each note’s meaning, to find it with other words: Cobrain works it out on its own servers and it is encrypted with the brain’s key like the text.

To be straight with you: this is not end-to-end encryption. Cobrain’s server opens notes and files to show them to you and to hand them to your AI. And the names and paths of notes and files, tags, dates, authors, file sizes and brain images stay readable: they are what the tree is built from and how you find things.

We send you a link, and in the same email a code: they work once, and you are in. Ask for another and the first stops working. To get in you have to invent nothing and remember nothing.

When you connect Claude, ChatGPT or another program, Cobrain shows you a page stating what that program will be able to read and write. If you authorise, the program receives a grant that expires and renews itself (OAuth 2.1, the standard). No key to copy, no secret left lying around. From the Connections page you revoke any program whenever you want, and from that moment it no longer gets in.

Every operation by an AI is logged: the note says who changed it, and the previous version can still be recovered.

The primary database and authentication run on Supabase in West EU (Ireland, eu-west-1), and application functions run on Vercel in Dublin (dub1). CDN, logs and other technical services may be distributed: suppliers and safeguards are described on the privacy page. We do not sell data, profile users or use notes to train models.

Cobrain sends your notes to no model. It is the programs you connect that read them, when you ask them to in a conversation. What Claude or ChatGPT then do with what they read depends on their terms and on the settings you have with them. You are better off knowing, which is why we write it here rather than in a footnote.

Before you share a branch, Cobrain shows you what is in it and warns you if it holds a note that looks confidential. Whoever receives sees that branch and nothing else, and so does their AI. You can give read-only access, and you can take everything back whenever you want. If you give someone a folder higher up, the folders they already had inside it merge into it, and the window tells you first.