TL;DR
- An agent that reads your files and acts in your accounts needs a higher privacy bar than a chatbot, because the blast radius is larger.
- Five rules: your data is never training data, never for sale, your agent runs against an isolated data store, credentials belong in an encrypted vault, and tool access stays permissioned and inspectable.
- Privacy for an agent is also about permissions: what shell, file and browser access it gets, and what a validator refuses to run.
- Runaway guards — call budgets, idempotency, loop detection — plus a queryable audit trail of every run, step and tool call.
- Your choice of runtime: the agent's hands-on tools can run on your own machine instead of our cloud.
An AI company can choose to use customer activity for product analytics, model improvement, or advertising. Those choices belong in an explicit policy rather than being hidden behind a generic promise that data is “private.”
We chose a different path. Here is why.
The Moment It Clicked
Early in development, someone on the team asked a simple question during a standup: “What happens if a user talks to their agent about a medical issue? A financial problem? A fight with their partner?”
The room went quiet.
A Brainmox agent can read authorized files, work with connected Google services, use credentials through its vault, and retrieve persistent conversation and memory records. That concentration of access is useful—and needs boundaries that match the enabled workflow.
The result is a set of product and business rules: customer content is used to provide the service, not to train shared models or sell advertising; customer stores are isolated; production access is restricted and logged; supported activity is recorded for review.
The Rules We Build By
Your content is not used to train shared models. Conversations, files and memory records are retained to provide your service under CloudAid’s policy, not contributed to a shared training corpus. Persistent records can improve continuity through retrieval; they do not retrain the model.
Your data is never for sale. Our business model is the subscription. You pay for the product; the product doesn’t pay for itself with your data. There are no ads, no marketing trackers, no data brokers, no session replay.
Your agent lives alone. Every customer’s agent runs against its own isolated data store — conversations, memory, knowledge base, and files are never mingled with other customers’ data in shared tables. Isolation isn’t a tier or an add-on; it’s the default architecture.
Vault secrets never reach the model. Passwords, API keys, and tokens stored in the vault are encrypted with XChaCha20-Poly1305, with a key derived from your passphrase via Argon2id. Tools reference them as placeholders that resolve only for eligible execution, and any resolved value in a tool result is removed before work continues.
Ordinary context is not a secret store. Calling a model means sending selected conversation and tool context to a provider. Brainmox does not generally detect and remove sensitive text pasted into prompts or present in ordinary tool content. Credentials belong in the encrypted vault, not in a conversation, document, memory, task or CRM field.
Power Needs Boundaries
Privacy for an agent isn’t only about where data sits. It’s about what the agent is allowed to do with the access you’ve given it.
- Per-agent permissions. You decide how much shell, file, and browser access your agent gets — full, limited to what you allow, or none at all.
- Hardened execution. Every shell command passes a validator that blocks dangerous patterns — destructive flags, pipe-to-shell installs — before it runs.
- Runaway guards. Call budgets, idempotency guards, and loop detection stop an agent from burning through your accounts, your wallet, or a remote API. (How that gate is built, in detail.)
- A full audit trail. Every run, every step, every tool call is logged in a queryable journal — and because every agent is a named individual, you know which one acted. You can inspect any tool call and review any decision. Transparency is not optional. It is built into the product.
- Your choice of runtime. If you want your agent’s hands-on work happening on hardware you control, its tools — shell, files, browser — can run on your own computer or a dedicated machine instead of our cloud.
Is it harder to build this way? Yes. We could personalize more aggressively if we treated every customer’s data as one big corpus. We accept that trade-off, because the alternative — asking you to hand your most personal thinking to a system with no boundaries — is not ours to ask for.
The Principle
Your AI assistant is the most intimate software relationship you will ever have. It knows how you think, what you are working on, what you worry about, and what you aspire to.
That relationship only works if it is built on trust. And trust does not come from a slogan. It comes from architecture you can verify: data that stays isolated, vault secrets the model cannot see, actions you can audit, and a company whose only revenue is the subscription you chose to pay.
We are not claiming we have solved every privacy challenge in AI. What we are saying is simpler: we started with a principle, and we have not compromised on it since day one. Your data is yours. It works for you and no one else. And we will keep building it that way.
The short version of all of this lives on our security page.
That is Brainmox.
Brainmox is an AI agent with persistent memory, real identity, and privacy-first architecture. Built by CloudAid Inc. Currently in private beta. Learn more at brainmox.com.