Trust · Tenant isolation

One company, one boundary, nothing crosses

Your workspace is yours. Data from another company can’t appear in your results, and yours can’t appear in theirs.

A workspace is a company is a security boundary.

Inside a workspace you can model many brands, units and legal entities. Between workspaces there is a wall.

How the wall is built

1

Identity from erp.io

Brigham.ai has no sign-in of its own. A signed hand-off from erp.io carries your organization, verified against its public keys.

2

No org, no entry

A token with no organization is refused before any lookup happens.

3

Users mirrored on org and email

A user is identified by the pair (organization, email), never by email alone. The same address in two organizations is two separate people.

4

Every row carries the workspace id

Every table that holds customer data has a workspace column.

5

Every query is scoped

Queries filter on that id in the service layer, not in the page and not in the prompt.

Tests that sign in for real

Isolation tests don’t stub the user. They go through the real sign-in path as people in different organizations and assert that the second organization sees nothing of the first: not in lists, not in search, not in memory, not by guessing an id. Mocked actors can hide the exact bug these tests exist to catch.

Real sign-in, not a fake actor
Cross-org reads must come back empty
Run on a real database engine

Boundaries at a glance

Between workspaces: Nothing crosses
Inside a workspace: Company, brand and business-unit entities with ownership and operating relationships
Holding companies: One workspace can hold many entities. Each workspace stays its own boundary, so nothing crosses between workspaces
Billing: Plan and entitlement owned by erp.io. Brigham.ai stores no card data

Questions, answered.

Why not identify users by email?

Matching on email alone lets a person in one organization be adopted into another that shares the address. Keying on (organization, email) closes that class of leak.

Is the database shared?

Brigham.ai runs its own database. Within it, isolation is by workspace id on every row and query.

Keep reading.

Holding companiesOne workspace holds many companies, brands and business units with their ownership and operating relationships. Reports cite their source, with no cross-tenant reads.Read →

AgenciesRun client work across tenants with real walls between them. Client-confidential data is never summarized into another tenant’s memory.Read →

Protected domainsProtectedFinance data is visible only to people who hold an explicit grant. Roles give nothing, and the label follows every piece of derived data.Read →

Policy is codeEvery Brigham.ai tool call runs one pipeline of checks in code. The model never decides what it is allowed to do.Read →

Bring many brands, keep one wall

Request access and set up your companies as entities in a single workspace.

Get started Talk to us