GDPR & sovereign
data architecture.
Brevio Harness is engineered from the ground up for strict European data sovereignty. By combining a 100% self-hosted runtime with Zero Web Secrets, your source code, git credentials, and personal data remain under your exclusive sovereign control.
100% BYOK Architecture
Zero Data Retention (ZDR)
Verifiable Crypto-Erasure
Zero Cross-Site Tracking
Data protection by mathematical design
Data Protection by Design & Default
Brevio Harness runs on a sovereign Bring-Your-Own-Keys (BYOK) architecture inside your own Coolify, Docker Compose, or VPS environment. Your GitHub tokens, source code, and model API keys never touch or transit Brevio web servers.
Cryptographic Shredding & Right to Erasure
Every workspace state and audit trail is encrypted with tenant-unique X25519 age keys. When an offboarding or deletion request is initiated, purging the tenant key mathematically guarantees irreversible cryptographic erasure across all snapshots.
Zero Data Retention (ZDR) Enforced
Upstream LLM providers (Anthropic, OpenAI, Azure, Mistral, or local Ollama) receive strict zero-retention flags (`store: false`) on every inference request. Customer prompts and completions are never utilized for model training.
Sovereign EEA Data Residency & Transfers
You choose where your inference and database execute. Deploy in Frankfurt, Dublin, Paris, or on-premise without transferring personal or proprietary data across international borders.
Clear separation of processing boundaries
As the licensee of Brevio Harness, you maintain sole legal control over your repository, your codebase, your customers' data, and the decisions made by the autonomous agents. Brevio Ventures possesses zero access to your execution environment, database, or private keys.
- • You define repository access permissions
- • You review and approve protected pull requests
- • You specify LLM inference endpoints & data regions
Brevio software functions strictly as an autonomous orchestration engine executing on your self-hosted infrastructure. For the public website (brevio.pro), Brevio acts as Controller solely for minimal operational server logs and checkout metadata via Polar.sh.
- • Zero cross-site tracking or advertising cookies
- • All web server telemetry is aggregate and anonymized
- • Polar.sh processes payment data with PCI-DSS Level 1
Fulfilling Data Subject Rights (Articles 15–22)
How data subject requests are handled under Brevio's architectural model:
Inspect all operational logs and configuration files directly inside your self-hosted database (`harness_state.db`). You have immediate, unfiltered access to all data at all times.
Update blueprint schemas, tenant metadata, or model routing rules via the `cli.py` command line interface or `/node` remote control dashboard in real time.
Trigger complete workspace destruction with `cli.py tenant destroy --purge`. Tenant database rows and encrypted volume mounts are purged immediately.
Export your complete blueprint bundle (`CONSTITUTION.md`, `CLAUDE.md`, `roadmap.json`, and Docker Compose definitions) in open standard formats with one click.
Pause autonomous background lanes instantly via Discord command `/pause` or through the interactive circuit breaker in your self-hosted console.
Zero Cookie Banner Required (ePrivacy Directive 2002/58/EC)
brevio.pro does not set non-essential cookies, profiling trackers, or third-party advertising pixels. Because we do not store or access information on your terminal device beyond strictly necessary technical transmission cookies, no disruptive cookie consent banner is legally required under Article 5(3) of the ePrivacy Directive and EDPB Guidelines 01/2023.
EuroComply Model Context Protocol (MCP)
Every roadmap slice generated by Brevio is audited in real-time (<150ms) against GDPR Chapter V and EU AI Act (Regulation (EU) 2024/1689) Annex III obligations before pull requests are created.
Data Protection Officer & Legal Inquiries
For questions regarding data sovereignty, GDPR compliance, or to execute a bespoke Data Processing Addendum (DPA):