Written for information governance leads, data protection officers and anyone assembling a DPIA. It describes what the software does, and says plainly where an answer is a commitment rather than a property of the product.
Hosting jurisdiction, the data processing agreement, the subprocessor list and certification status are commercial and legal commitments. We answer them precisely, in writing, for the arrangement you would actually be on — rather than publishing a sentence that stops being true when the infrastructure changes.
Ask for them in writingContracts, service specifications and approved organisational information — plus the accounts of the staff who use it. That is the whole list.
Enforced in the database rather than in application code — so a query that forgot to filter returns nothing, instead of returning everything.
Every table carrying customer content is policed on the organisation it belongs to. The policies are forced, and the application connects as a role that cannot bypass them.
The tenant is set for the duration of a single transaction, so a connection reused from a pool cannot carry one customer's context into another customer's request.
Eight roles, each a combination of four rights, enforced on the server rather than by hiding buttons. A receptionist can read approved answers and cannot start an extraction or approve a communication.
One model provider, used for four features, on documents you chose to upload.
Your documents are not used as training data by us or by the model provider.
The record of who decided what is a compliance artefact, so the software treats it as one.
Configurable per organisation, seven years by default, measured from upload. The clock uses the newest version, so a reissued contract is current however old version one is. Nothing here knows when a contract actually ends, and the interface says so rather than implying a precision it does not have.
Deleting a document removes every version, its extractions and the stored files. Erasing the index and leaving the contract on disk would not be erasure. On versioned storage that means removing every version rather than writing a delete marker.
The retention sweep reports what has expired and removes nothing until an administrator turns deletion on, having read the reports. Every sweep is recorded, including the ones that deleted nothing — so both "why has this gone?" and "why is this still here?" have an answer.
Extracted items export to CSV at any time. You are not locked in to get your own contract knowledge back out.
InBrief runs on managed cloud infrastructure in Europe, with a managed PostgreSQL database and object storage, and uses a single model provider for the four AI features. The exact regions, the processors involved and the terms that bind them belong in a data processing agreement rather than on a marketing page, because they are the part a controller has to be able to rely on — and the part most likely to change.
Ask, and we will give you the current answer in writing, for the arrangement you would actually be on: region, subprocessors, retention configuration, breach notification and the DPA itself.
InBrief gives no clinical advice, makes no diagnosis, performs no triage, and recommends no medication or treatment. It reads contracts and drafts administrative communications for a person to approve. Those boundaries are the reason it sits outside the medical device regime, which is why they are enforced in the software rather than written as a caveat.
InBrief is an independent software product. It is not affiliated with, endorsed by, or accredited by the NHS or any of its bodies, and it carries no NHS branding. Where it describes a contractual requirement, the contract you uploaded is the authority — not InBrief.
These are boundaries, not gaps waiting to be filled.
We would rather answer a hard question early than discover it in week six of a procurement.