Your AI cannot do more than you.
Permissions are not applied by the application: they are applied by the database, on the same rule for the site and for the AIs. A branch you have not shared cannot be reached, by anyone and by any AI. Here is how it is built, and why.
The rule
One rule, applied where the data lives.
A person sees a note if it is theirs, or if somebody shared with them the branch it sits in. That is all. This rule is not written in the interface, where a check can be forgotten: it is written in the database, which applies it to every single read and write, wherever it comes from. The site is subject to it. The AIs are subject to it. So are we.
The practical consequence: a connected AI works with exactly your permissions. It reads what you read, writes where you can write. There is no side door.
How you sign in
With a link and a code by email.
We send you a link, and in the same email a code: they work once, and you are in. Ask for another and the first stops working. To get in you have to invent nothing and remember nothing.
How the AIs connect
With an authorisation, not with a key.
When you connect Claude, ChatGPT or another program, Cobrain shows you a page stating what that program will be able to read and write. If you authorise, the program receives a grant that expires and renews itself (OAuth 2.1, the standard). No key to copy, no secret left lying around. From the Connections page you revoke any program whenever you want, and from that moment it no longer gets in.
Every operation by an AI is logged: the note says who changed it, and the previous version can still be recovered.
Where the data lives
In Europe. In Ireland.
The database and the authentication live on servers in Ireland, and the application runs in Dublin, next to the data. The few suppliers we use are listed in the privacy policy, with what they do. We do not sell data, we do not profile, we do not use your notes to train models, and we do not read them unless you ask us to for support.
What the AIs do with what they read
That is up to them, and we say so.
Cobrain sends your notes to no model. It is the programs you connect that read them, when you ask them to in a conversation. What Claude or ChatGPT then do with what they read depends on their terms and on the settings you have with them. You are better off knowing, which is why we write it here rather than in a footnote.
When you share
You see what you are about to hand over.
Before you share a branch, Cobrain shows you what is in it and warns you if it holds a note that looks confidential. Whoever receives sees that branch and nothing else, and so does their AI. You can give read-only access, and you can take everything back whenever you want.
Sign in with a link.
It arrives by email. You connect your AI and see with your own eyes what it can and cannot do.
