Security and privacy, clearly explained
Breyta is built for production workflows. This page summarizes how we handle customer content, secrets, access control, runtime safety, and third-party provider responsibility.
For binding detail, review our Privacy Policy, Terms of Service, Data Processing Agreement, and Subprocessors page.
At a glance
SOC 2 Type II compliant
Breyta is SOC 2 Type II compliant and maintains formal security controls for enterprise reviews.
GDPR compliant
Our privacy and data-processing terms are structured around GDPR requirements and linked below for detailed review.
No training on Customer Content
Breyta does not train its own models on Customer Content.
BYOK responsibility split
When you configure third-party AI providers, provider-side processing is governed by your agreement with that provider.
Google Cloud Platform in EU regions
Breyta production workloads run on Google Cloud Platform, with production hosting primarily in EU regions.
Secrets stay separate from flow logic
Secrets and credentials are stored securely and referenced through connections and secret refs instead of being embedded in flow definitions.
Workspace-scoped access
Connections, workflows, and permissions are scoped to workspaces and controlled through role-based access.
How Breyta handles security in practice
Workspace access and governance
Workspace membership and roles determine who can view, edit, activate, and manage workflows and connections. Privileged actions stay restricted to privileged workspace roles.
Secrets and credentials
Breyta stores secrets with KMS-backed envelope encryption and resolves them through secret refs and managed connections instead of asking teams to hardcode credentials into workflow files.
Runtime safety and webhook authentication
Webhooks support authenticated trigger configurations, including HMAC, signature, bearer-token, and API-key modes. Signing secrets are bound through flow configuration rather than committed into workflow definitions.
Logging, monitoring, and auditability
Breyta maintains operational and security logging, run history, and version history to support incident response, enterprise review, and day-to-day debugging.
Storage location and retention controls
Breyta uses Google Cloud Platform for core infrastructure, with production workloads primarily in EU regions. Workflow history retention is plan-based, up to 365 days on Enterprise, and workspace files and persisted resources support retention and TTL controls within current platform limits.
Customer-managed systems are supported
Breyta workflows can bind your own databases, blob storage, key value stores, HTTP APIs, and model providers through managed connections instead of forcing all durable data into Breyta-managed systems.
Common questions
Are you GDPR and SOC 2 Type II compliant?
Do you use customer content to train your own AI models?
How does BYOK change responsibility for data processing?
How are secrets and credentials handled?
Who can access data inside a workspace?
How are webhooks and external triggers secured?
Where is Breyta data hosted?
Can we use our own database or infrastructure instead of Breyta-managed storage?
Where can I review your DPA, subprocessors, and privacy terms?
How do you handle retention and deletion?
Related documents
Privacy Policy
How Breyta processes personal data across the website, APIs, CLI, and workflow services.
Terms of Service
Commercial terms for service use, account responsibility, customer content, and security posture.
Data Processing Agreement
Processor obligations, security controls, transfers, subprocessors, and breach notification terms.
Subprocessors
Current Breyta subprocessors, transfer mechanisms, and operational purpose.
Help Center: Security & Privacy
Supporting FAQ articles on roles, BYOK, monitoring, retention, and legal references.
Need a security review or procurement package?
If your team needs additional security or privacy material, contact us and we'll help you route the right documents and answers quickly.
Last updated: March 15, 2026