Is Brea AI safe? How we protect your email, logins and payments

Yes, for most people Brea AI is safe to use. Brea is the AI assistant you text in iMessage, and it works inside your email, calendar and other apps. We built it so it asks before anything important happens, never sees your passwords, and never trains AI models on your data. It has passed Google's CASA Tier 2 security assessment. It is not SOC 2 certified yet, and we say more about that below.

We're the two people who build Brea, so read this knowing who wrote it. Everything here matches our security page and our Trust Center, where you can check it yourself.

What Brea can and can't do without you

Brea does real work, which is the whole point. You text it "reply to the Hendersons and say Thursday works" and it drafts the reply in Gmail. That's also why people ask whether it's safe.

Before Brea sends, deletes, shares or changes a setting, it asks you in iMessage. You reply allow, always or deny. When it wants to send an email, you see the draft first. If you pick always for a type of action, Brea stops asking for that one, and you can change your mind later.

Payments work the same way. Brea pays only after you approve the payment in Link by Stripe, and each purchase uses a new one-time card. Your card number never goes through the chat.

Your passwords stay out of the AI

Some tasks need you signed in to a website, like booking at a clinic or changing a reservation. Brea never asks you to text it a password. It sends you a link to a secure Brea page where you save the login yourself.

• Saved logins are encrypted with AES-256-GCM and tied to your account.
• The model never sees the password. Passwords and tokens are attached on our servers when a tool runs, and the AI only holds a reference to them.
• Everything is encrypted in transit with TLS and encrypted at rest.

We wrote up the details in how Brea browses, signs in and pays.

Your data isn't used to train AI

Your conversations, files and connected app data never train an AI model. We don't sell your data, and we don't share it with advertisers.

Each person gets their own isolated agent and sandbox. No other customer can reach your agent, its storage or your data.

You stay in control of access

• Brea connects only to the apps you approve. When it needs a new one, it texts you a secure link to connect it.
• Disconnect an app and your agent loses access right away.
• You can see what Brea remembers about you and delete it, or just text it to forget something.
• You can delete your account whenever you want.

Certifications

Brea is CASA Tier 2 verified. CASA is the Cloud Application Security Assessment run under the App Defense Alliance, and Google requires it before an app can work with restricted data like Gmail. Brea is also a Microsoft Verified Partner.

We don't have a SOC 2 report yet. Our SOC 2 Type 2 audit is underway with Vanta, and the Trust Center shows where it stands. If your company requires SOC 2 today, we'd rather tell you that up front.

Is this the same Brea as the AI receptionist app?

No. There's an unrelated company called Brea AI Receptionist that answers business phone calls (talkbrea.ai). We're Brea AI LLC at brea.ai, the assistant you text in iMessage. Different team, different product, different data.

Try it and decide for yourself

Brea is free to start, with every feature included and no credit card. Sign up with your phone number, then text something small, like "what's on my calendar tomorrow?" or "find the email from my landlord about the lease." You'll see exactly what it asks before it acts. Have more questions? Reach us at [email protected].