Data Processing & Security Policy

This policy explains how Gulf Stream Tech Group, LLC (“BrytIO,” “we”) handles the data you and your team put into BrytIO to run your business (“Customer Content”): how it’s stored, secured, shared, retained, and deleted. For personal information where we are the controller (your account, billing, and website data), see our Privacy Policy.

You are the controller, we are the processor

Customer Content belongs to you: your contacts, companies, deals, quotes, invoices, payments, shipments, attachments, synced emails, and anything else you enter or import. You are the controller of the customer data in your workspace, and BrytIO is the processor. We handle it only on your instructions and to provide the service. You are responsible for having a lawful basis to collect and use the data you put into BrytIO, and for meeting your own privacy obligations to the people it describes.

How we use Customer Content

We process Customer Content only to:

• Provide, maintain, secure, and support the product for you
• Perform the actions you take in the app (create records, send email, sync an integration you connected, generate an AI draft you requested)
• Write the AI note in the weekly digest email, on plans that include AI (described below)
• Prevent fraud, abuse, and security incidents
• Comply with law

We do not sell or rent your Customer Content, use it for advertising, or use it to train AI models, yours or anyone else’s. We access it only as needed to operate the service, support you (with your authorization), or comply with law.

Where your data lives

The application and database run on Microsoft Azure in the United States. The database is managed by BrytIO. File attachments and encrypted database backups are stored in Cloudflare R2 object storage.

Subprocessors

We use the following subprocessors and services to provide BrytIO. An integration is only active if you connect it.

To show company logos, BrytIO fetches the public website of a company you add (domain only) and, as a fallback, Google's favicon service. When a logo loads in your browser, such as the preview while you type your website during setup, Google also receives your IP address and browser details.

We will give notice before a new subprocessor starts processing Customer Content, so you have a chance to object.

Security measures

• Connections are encrypted with TLS, from your browser to Cloudflare and from Cloudflare to our servers. Plain HTTP is redirected to HTTPS.
• The database is stored on disks that Azure encrypts at rest (server-side encryption with platform-managed keys).
• Access tokens for connected integrations, such as Microsoft 365, and 2FA secrets are encrypted a second time by BrytIO, with AES-256-GCM, under a key kept outside the database.
• Each record belongs to one workspace, and the application scopes its reads and writes to your workspace. That scoping is covered by automated tests.
• Owner, admin, and member roles decide who can see financial data, manage the team, and change workspace settings.
• Two-factor authentication (TOTP) is available on every account, and workspace owners and admins can require it for all members.
• The database is backed up nightly. Each backup is encrypted before it leaves the server and is stored off-site.
• Application errors are reported to Sentry. Request bodies, cookies, and auth headers are removed before a report is sent, and session replay is off.
• Code changes run through automated type checks, unit tests, and a full build in CI.

No system is perfectly secure, and we keep working to strengthen these measures.

AI processing of Customer Content

When you use an AI feature, we send the content and context that request needs to Anthropic (Claude) to generate the result. One AI task runs without anyone asking: on plans that include AI, unless a workspace owner or admin has turned AI off, the Monday weekly digest email to the workspace owner carries a short AI-written note on where to focus that week. To write it, we send Anthropic a summary of that workspace: its name; its open deal, overdue invoice, expiring quote, and task counts and totals; the title and value of the largest open deal; and the number, customer name, amount, and date of the oldest overdue invoice and of the quote closest to expiry.

Your data is not used to train AI models, and inputs and outputs are not retained by the model provider for training. AI features are available only on plans that include them.

A workspace owner or admin can turn AI off for the whole workspace, and choose whether it may read the text of logged emails and the files you upload. On plans with AI, all three start on: AI itself, reading the text of logged emails, and reading uploaded files. Nothing AI suggests changes your records until a person approves it.

Retention and deletion

• While active: we retain Customer Content for as long as your workspace is active so the product works.
• Export: You can download your contacts, companies, deals, quotes, invoices, expenses, and shipments as CSV files at any time (invoices and expenses by owners and admins). On Team and Enterprise plans, the REST API also returns your contacts, companies, deals, quotes, invoices, and shipments.
• Deletion: Deleting a record removes it from the app. Deleting a workspace removes its records from our production database. Encrypted database backups that still contain them expire after 60 days. If the law requires us to keep some data longer, we keep it only as long as required.

Breach notification

If we become aware of a security incident affecting your data, we will notify you without undue delay, describe what we know, and tell you what we're doing about it.

Your responsibilities

• Ensure you have the right and a lawful basis to collect, upload, and process the data you put into BrytIO
• Provide any notices and obtain any consents your own customers require
• Keep your credentials secure and manage your team’s access

Data Processing Agreement

Our Data Processing Agreement is in legal review. Ask through the contact form and we'll send it once it's final. On the contact form, choose “Privacy & data requests.”

Contact

For data and security questions, use our contact form and choose “Privacy & data requests.”