Security is part of the workflow.
Review the controls, retention boundary, data location and assurance status that apply before your practice uses Briefly.
Compliance & Assurance
Current assurance status and documentation scope
Healthcare Privacy Safeguards
We implement administrative, physical, and technical controls designed around healthcare privacy and security standards to protect sensitive health information.
Business Associate Agreement
Contact the Briefly team to discuss whether a Business Associate Agreement is available for your organisation and intended use.
SOC 2 Type II
Contact the Briefly team for current independent assurance documentation and its scope.
Secure Data Residency
Clinical recordings and letters are stored in Australia. Contact the Briefly team to discuss your practice’s data-handling requirements.
Purpose-Built for Clinicians
Practical controls support clinician review and accountable data handling.
Frequently Asked Questions
Where is my data stored?
Clinical recordings and letters are stored in Australia. Contact the Briefly team to discuss your practice’s data-handling requirements. Some backend processing — such as transcription and letter generation — uses third-party providers. Australian storage does not mean every processing activity takes place in Australia. Contact the Briefly team for current processing-location and contractual documentation.
Is patient data used for model training?
Patient data is not used for model training. Request current subprocessor and contractual documentation for processing and retention details.
What privacy laws apply to my data?
Privacy requirements depend on your organisation, location and use. Read the Australia regional guidance for an overview, then confirm the obligations that apply to your practice with your own advisers.
Security Architecture
Multi-layered protection for your sensitive patient data
Encryption at rest and in transit
AES-256 encryption at rest and TLS 1.2 or later in transit.
- AES-256-GCM encryption at rest
- TLS 1.2 or later in transit
- Request current encryption and key-management documentation
Secure Data Storage
Briefly supports clinical correspondence and is not a replacement for an electronic health record. It provides a 30-day processing workspace. Letters are deleted from Briefly on a daily schedule under a 30-day retention period and can be deleted from 28 days after creation. Export to file them in your practice’s record system.
- Access-controlled storage, scoped to your practice
- Recordings and letters deleted on a daily schedule under a 30-day retention period and can be deleted from 28 days after creation
- Export options for filing approved correspondence in your own system
- Access events available for investigation
Access Controls
Account, role and session controls keep access scoped to authorised users.
- Account authentication
- Role-scoped access where configured
- Session management and timeout
- Ask for current identity-control documentation
Operational Oversight
Operational records and monitoring support investigation and incident response.
- Application error and availability monitoring
- Operational alerts for investigation
- Documented incident-response contact
Infrastructure & Operations
Current infrastructure and operational boundaries
Cloud Infrastructure
Clinical recordings and letters are stored in Australia. Contact the Briefly team to discuss your practice’s data-handling requirements.
Patient Data and Model Training
Patient data is not used for model training.
Audit Records
Application records support investigation. Ask for the current event scope and retention before relying on them for an assurance programme.
Incident Response
Ask for the current incident-response process, contacts and notification commitments that apply to your organisation.
Secure Development Practices
Security is embedded in every stage of our development process
Security Inquiries
Need detailed security documentation, want to report a vulnerability, or have questions about our compliance?
We take security reports seriously and respond promptly.
For enterprise security documentation:
Ask about available security documentation, independent assurance and test results, or Business Associate Agreement.
For vulnerability disclosure:
Reports are reviewed through the responsible-disclosure process.