# Security and privacy, clearly explained

Breyta is built for production workflows. This page summarizes how we handle customer content, secrets, access control, runtime safety, and third-party provider responsibility.

For binding detail, review our Privacy Policy, Terms of Service, Data Processing Agreement, and Subprocessors page.

## At a glance

### SOC 2 Type II compliant

Breyta is SOC 2 Type II compliant and maintains formal security controls for enterprise reviews.

### GDPR compliant

Our privacy and data-processing terms are structured around GDPR requirements and linked below for detailed review.

### No training on Customer Content

Breyta does not train its own models on Customer Content.

### BYOK responsibility split

When you configure third-party AI providers, provider-side processing is governed by your agreement with that provider.

### Google Cloud Platform in EU regions

Breyta production workloads run on Google Cloud Platform, with production hosting primarily in EU regions.

### Secrets stay separate from flow logic

Secrets and credentials are stored securely and referenced through connections and secret refs instead of being embedded in flow definitions.

### Workspace-scoped access

Connections, workflows, and permissions are scoped to workspaces and controlled through role-based access.

## How Breyta handles security in practice

### Workspace access and governance

Workspace membership and roles determine who can view, edit, activate, and manage workflows and connections. Privileged actions stay restricted to privileged workspace roles.

### Secrets and credentials

Breyta stores secrets with KMS-backed envelope encryption and resolves them through secret refs and managed connections instead of asking teams to hardcode credentials into workflow files.

### Runtime safety and webhook authentication

Webhooks support authenticated trigger configurations, including HMAC, signature, bearer-token, and API-key modes. Signing secrets are bound through flow configuration rather than committed into workflow definitions.

### Logging, monitoring, and auditability

Breyta maintains operational and security logging, run history, and version history to support incident response, enterprise review, and day-to-day debugging.

### Storage location and retention controls

Breyta uses Google Cloud Platform for core infrastructure, with production workloads primarily in EU regions. Workflow history retention is plan-based, up to 365 days on Enterprise, and workspace files and persisted resources support retention and TTL controls within current platform limits.

### Customer-managed systems are supported

Breyta workflows can bind your own databases, blob storage, key value stores, HTTP APIs, and model providers through managed connections instead of forcing all durable data into Breyta-managed systems.

## Common questions

Are you GDPR and SOC 2 Type II compliant?

Do you use customer content to train your own AI models?

How does BYOK change responsibility for data processing?

How are secrets and credentials handled?

Who can access data inside a workspace?

How are webhooks and external triggers secured?

Where is Breyta data hosted?

Can we use our own database or infrastructure instead of Breyta-managed storage?

Where can I review your DPA, subprocessors, and privacy terms?

How do you handle retention and deletion?

## Related documents

### Privacy Policy

How Breyta processes personal data across the website, APIs, CLI, and workflow services.

[Open document](/content/privacy-policy/index.html)

### Terms of Service

Commercial terms for service use, account responsibility, customer content, and security posture.

[Open document](/content/terms-of-service/index.html)

### Data Processing Agreement

Processor obligations, security controls, transfers, subprocessors, and breach notification terms.

[Open document](/content/data-processing-agreement/index.html)

### Subprocessors

Current Breyta subprocessors, transfer mechanisms, and operational purpose.

[Open document](/content/subprocessors/index.html)

### Help Center: Security & Privacy

Supporting FAQ articles on roles, BYOK, monitoring, retention, and legal references.

[Open document](/content/help/security-privacy/index.html)

## Need a security review or procurement package?

If your team needs additional security or privacy material, contact us and we'll help you route the right documents and answers quickly.

[Contact hello@breyta.ai](mailto:hello@breyta.ai)

Last updated: March 15, 2026