Security controls for client documents.
Brokers hold some of the most sensitive paperwork in the economy. Bramble is built so that using AI on it does not change who controls it, where it lives, or who signs off on the output. Approval is enforced where your regulator requires it and configurable where it does not.
North American data residency
You pick your region at onboarding, in the United States or in Canada. Documents are processed in the region they were uploaded to and nothing is copied out of it for convenience, so a US brokerage keeps its files in the US and a Canadian one keeps them in Canada.
No model training on client data
Your documents are used to answer your questions and nothing else. They are not used to train or fine-tune models, and they are not pooled across brokerages. Retention windows are set by you.
Analysis is cited, not approved
Extraction, comparison, and gap detection do not sit behind a sign-off queue. Every value comes back with the verbatim quote it came from, so your team verifies in seconds rather than re-reading the document. No regulator asks a licensed person to countersign a reading of a lease, and we do not pretend otherwise.
Issuance requires a licensed person
The regulated act is issuance, and Bramble stops short of it. Nothing binds, issues, or reaches a client without a person approving it. In Canada that gate is enforced and cannot be switched off. In the United States you set the threshold yourself, per team and per document type, and it ships defaulted on.
Audit logs and source citations
Every extraction, comparison, and edit is timestamped and attributed, with the verbatim source quote attached. When an E&O question comes back years later, the file already answers it.
User access controls
Named accounts per user, role-based permissions per case, and immediate revocation when someone leaves. SSO for brokerages that require it. Ask us for the current security questionnaire, subprocessor list, and DPA. We send them in full, unredacted.
Security review questions
Which models do you use, and where do they run?
Bramble uses commercial frontier models under enterprise agreements that prohibit training on submitted content, invoked from our North American infrastructure. We will name the current providers under NDA during procurement.
Can Bramble issue a certificate on its own?
No. Bramble prepares the document and stops. A licensed person reviews and approves before anything is issued or reaches a client, and that holds for the roadmap features that write into your BMS. Canadian brokerages cannot turn the gate off; US brokerages set their own threshold and it ships defaulted on.
Our state does not require broker sign-off. Does Bramble slow us down?
No. The approval gate is a setting, not a constraint of the product. US teams choose which document types need a person and which do not, by team, and can move that line as they get comfortable. Canadian teams keep the gate because their licensing regime requires it.
What happens to a document after we are done with it?
You choose the retention period per brokerage. Deletion removes the document and its extractions; the audit record of who did what remains, without the underlying file.
How is accuracy measured?
Every value is returned with a verbatim quote so your team can verify it in seconds. On adversarial test policies Bramble reached 100% recall with zero false positives, and the citation means you never have to trust a number blind.
Send us your security questionnaire.
We answer it in full, and we will walk your compliance lead through the architecture on the same call as the demo.