GDPR-compliant onboarding
GDPR-compliant client onboarding, built into the platform
Each organization's data lives in its own isolated database schema, encrypted in transit and at rest, with health and other special-category fields encrypted at the column level. Retention is set per workflow, erasure and access requests are handled per case, and everything runs on infrastructure hosted in the EU.
- Each organization isolated in its own database schema
- Encrypted in transit and at rest, special-category fields column-level encrypted
- Retention modes per workflow: Full, Metadata-only, Pass-through
How is my clients' data kept separate from other organizations
Every organization's data lives in its own isolated database schema, not shared rows separated by a filter. One organization's records are structurally apart from another's, so a query built for one organization simply finds nothing that belongs to a different one.
Is the data actually encrypted
Yes, in transit and at rest. Health information and other special-category fields, the kind that need the most care, are encrypted at the column level rather than relying on database-wide encryption alone, so those specific values get an extra layer of protection.
How long is client data kept
Retention is a setting per workflow, not one fixed rule for every case: Full keeps the complete record, Metadata-only keeps a reduced record once the case is done, and Pass-through keeps effectively nothing after delivery. You choose the mode that matches what a given workflow actually needs to retain.
- Full: the complete case record
- Metadata-only: a reduced record after completion
- Pass-through: minimal retention after delivery
What happens if a client asks to have their data deleted or exported
Erasure and access requests are handled per case, so a client asking for their data to be deleted or provided to them is a request your firm can act on directly against the specific case in question, rather than an all-or-nothing operation.
Where is everything hosted, and who else touches the data
The platform is hosted in the EU. Sub-processors, the other companies whose infrastructure or services are involved in running Braigest, are listed on the privacy page, so you can see exactly who is in the chain before you rely on it.
Frequently asked questions
Is my organization's data mixed with other tenants in the same tables?
No. Each organization has its own isolated database schema, so data is structurally separated rather than only filtered apart within shared tables.
Is sensitive data like health information encrypted?
Yes. Data is encrypted in transit and at rest, and health and other special-category fields are additionally encrypted at the column level.
Can I control how long a workflow keeps client data?
Yes. Choose a retention mode per workflow: Full for the complete record, Metadata-only for a reduced record, or Pass-through for minimal retention after delivery.
What happens when a client asks me to delete or export their data?
Erasure and access requests are handled per case, so your firm can act on a specific client's request against that exact case.
Where is the platform hosted, and can I see the sub-processors?
It is hosted in the EU. Sub-processors are listed on the privacy page, so you can review who else is involved before relying on the platform.
Explore more of the platform
Ask us anything about data handling before you commit
Book a 30-minute call and bring your own data protection questions. We will answer them against the actual architecture.