What we hold
Where your data lives, in plain words.
This page is the same text the product shows under Settings, Data and privacy. If it isn’t true, it isn’t here.
What is kept
The records read from your files and connections into your graph, a receipt for every change, and your files themselves by the rules in the full details.
Where
In 3 places we run on managed providers: a graph database, an application database and a storage bucket.
For how long
Until you delete the source or the organization; an import you started after reviewing a file can be undone for 7 days by default.
Who can see it
Only the people in your organization: every record and file carries its organization id, and every query is limited to it.
Sign-in is email and password, or Google. Microsoft sign-in is off.
Who stores your data
| Who | What it holds | Where |
|---|---|---|
| Neo4j Aura | Your graph: the records read from your files and connections, and the links between them. | us-central1 |
| Supabase (PostgreSQL) | The application database: records from a reviewed file, a database connection or an event stream, receipts, findings and alerts, chat transcripts and the audit log. | us-east-2 |
| Google Cloud | Your files and the batches a database sync or an event stream brings in, in our storage bucket; the records each receipt keeps; the passwords of database connections made on the Data Hub; and AI requests sent to Vertex AI, which Google may keep in memory for up to 24 hours. | Storage bucket: us-central1. Connection passwords: us-central1. AI requests: Google’s global endpoint, which picks the region for each request. |
| Clerk | People’s names, email addresses and sign-in, and your organizations and roles. | Where that company keeps it; our settings do not choose a region |
| Resend | The emails we send: invitations, findings and cases routed to email, digests, and notices to owners. | Where that company keeps it; our settings do not choose a region |
Read full details
Today: shared, encrypted.
Your data sits in a graph database, an application database and a storage bucket that we run on managed providers and share across customers, separated from every other customer by an organization id on every record and file, enforced in every query.
Graph in us-central1; application database in us-east-2.
| What | Where it lives | What we do with it |
|---|---|---|
| Your files | Our storage bucket | Kept as the record of what arrived, for as long as the list below says |
| Your rows | Our application database and our graph database | Read into entities and links, for your organization only, and, from a reviewed file, a database connection or an event stream, into records too. There, rows that fail a check are kept aside, with the reason, until the source is deleted or the import that rejected them is undone |
| Database credentials you connect | Encrypted at rest; a connection made on the Data Hub keeps its password in our cloud provider’s secret store | Used only to read, when a sync runs: on the schedule you choose or when you press Sync now. A write-back, if an owner or admin turns it on, uses a separate sign-in you make for it. Never shown again after you save them |
| Questions and answers | Stored with their receipts | Sent to our AI provider, in our own cloud project, to write the reply. No model is trained on them |
| Findings and checks | Application database, per organization | Delivered where you route them; kept as your ledger |
| Receipts | Hash-chained table the database will not let anyone edit, or delete except when the organization itself is deleted. Newer receipts keep their records as one file, whose hash the receipt carries, in a storage bucket under a retention policy (not yet locked) that refuses deletes and overwrites; older receipts keep them in that table | Every change to your records: what changed and who decided. Readable and downloadable in the product |
| Audit log | Application database | Decisions, invitations, exports and settings, by whom, through what. Readable in the product |
| Sign-in | Our sign-in provider, email and password, or Google | Organizations and roles come from there. Microsoft sign-in is off. Single sign-on (SAML) is set up by our team for a Business or Enterprise organization that asks |
| Email we send | Our email provider, from our cerebrinode.com address | Invitations; findings and cases you route to email; the weekly digest and the daily line, which each person can switch off; plan and spend notices and deletion records to owners; hosting requests |
When a column is left out, or removed later, is it gone? For a source from a reviewed file, a database connection or an event stream: from everything CerebriNode keeps, the records, rejected rows, the graph, the uploaded file and the receipts, which hold counts, never the values. After removing a column CerebriNode vacuums the table, which frees the space the old values used. The database’s backups, kept by our database provider, still hold earlier copies until each backup expires; the removal’s receipt says so. For any other source, a column left out at import is never written to the graph; a JSON or Parquet file that landed in storage before it was imported is kept as it arrived and still holds it. A column already imported into such a source goes only when the source is deleted, and the receipts of the imports that wrote it keep its values.
Can an import or a deleted source be brought back? An import a person starts after reviewing a file (CSV, TSV, Excel, NDJSON, XML or Avro) can be undone by an owner or admin from its summary, which shows when the import finishes and until you close it or leave the page: what it added is marked deleted and what it changed gets its earlier values back, as a new version with its own receipt. Imports that run on their own, from a database sync, an event stream or a file that arrives, have no Undo button. The change history behind an undo is kept 7 days by default, or up to 90 days if you ask us, then purged, and the earlier data cannot be recovered. A deleted source of that kind keeps its records in the change history for the same window, and an owner can ask us to restore it. JSON, Parquet and PDF imports, inbound webhook events and older sources, imported straight away without a review, are not undone in one step: deleting the source removes what it wrote. Files deleted from our storage bucket stay recoverable for 7 days (the bucket's soft delete), then are gone. Every undo, restore and delete has a receipt, and deleting a source from a reviewed file, a database connection or an event stream ends with a record of what remains and until when.
What is true today
- Encrypted in transit: TLS to the graph and to our database.
- Encrypted at rest by the managed providers.
- Connection passwords are encrypted.
- A file you review before it is imported (CSV, TSV, Excel, NDJSON, XML or Avro), and each batch a database sync or an event stream brings in, is kept in our storage bucket, each version, until the source is deleted. One whose import leaves out any column, or hashes, masks or tokenizes one, is deleted once it is imported.
- A JSON, Parquet or PDF file that lands in your organization’s storage before it is imported is kept as it arrived, columns you left out included, until the organization is deleted: deleting its source does not remove it.
- A file imported straight away, without landing in storage first (the way older sources were made), is not kept, except a PDF, which is kept until its source is deleted.
- No model is trained on your data.
- AI answers are written by AI models that Google Cloud runs for us, in CerebriNode’s own Google Cloud project. Under Google Cloud’s terms Google does not use your data to train or fine-tune any model without our permission, and we have not given it. Google may hold a request in memory for up to 24 hours to answer faster, and may log prompts to check for abuse of its terms.
- Deleting a source deletes its entities. For a source from a reviewed file, a database connection or an event stream, its records, rejected rows and files go too, and the change history keeps the records 7 days by default; for any other source, the delete's receipt keeps a copy of the values removed.
- Run receipts and chat transcripts are kept until the organization is deleted.
- Delivery and MCP secrets are encrypted with AES-256-GCM under a scrypt-derived key.
- An owner or admin can download a JSON export from Settings at any time: the graph up to 10,000 records and 50,000 links, each source's settings, the members, and up to 10,000 audit log rows from the last 90 days. The rows the Data Hub stores and uploaded files are not in it.
- An owner can delete the organization and its data from Settings, General, and gets a record of every step and of what remains, where and until when.
- Sign-in is email and password, or Google. Microsoft sign-in is off.
Planned, not offered planned
- Your own database, your region. A graph database provisioned for your organization alone, in a region you choose.
- Inside your walls. CerebriNode running on infrastructure you operate, so your data never leaves it.
- HIPAA. Planned. Not offered today.
Sources we read today, and next.
Today
- CSV, Excel, Parquet, JSON
- PDF (text)
- PostgreSQL, synced on the schedule you choose; the sync only reads
Next planned
Google Sheets, MySQL, SQL Server, MongoDB, Snowflake, BigQuery, Salesforce, HubSpot, SAP, NetSuite, Kafka, change capture. Custom connectors do not exist yet.