Brimlo · autonomo.space
Security and data processing
How Brimlo handles workspace records, documents and AI requests.
Last updated: 2026-10-22
Who is responsible
The operator and privacy contact are identified in the Privacy Policy and Legal Notice. Brimlo is controller for account and service-operation data. For personal data about your customers and suppliers in professional records, you are normally the controller and Brimlo acts as processor under the DPA.
Document storage and access
Documents are stored in the workspace's documents bucket, configured as private. User-facing access uses authentication and database/storage policies tied to the owner. Viewing an original uses a time-limited signed link. Trusted server functions can access documents using server-only service credentials to perform requested operations. These controls do not mean that the operator or infrastructure provider is technically unable to access the content.
What AI receives
Receipt and invoice recognition (uploads and Gmail import) and the Brimlo assistant use Google Gemini. Voice input and IAE/CNAE activity-code suggestions use OpenAI models. All AI requests go through Lovable AI Gateway. For recognition, PDFs and images are submitted as files and spreadsheets or text files as extracted text, so the content can include names, tax identifiers, addresses and amounts: the model has to read them to fill in the record, so these fields are not masked. Manual entry is always available instead. When the assistant reads your workspace data, Brimlo removes names, tax identifiers (NIF/NIE/CIF/VAT), IBANs, emails, phone numbers and addresses before the request is sent; text you type into the chat yourself is sent as written.
AI training and retention
Brimlo does not use customer documents to train its own general-purpose AI models. Lovable's published privacy policy distinguishes app users' data from developer content and states that it does not train its models on app users' data. This provider statement is linked below. Processing requests, temporary retention, abuse monitoring and downstream model-provider terms are separate from training; this page makes no zero-retention commitment.
Transport, storage regions and encryption
Connections to autonomo.space, the backend and the AI gateway are encrypted with TLS 1.2 or TLS 1.3; TLS 1.0 and 1.1 are refused, and the site sends HSTS so browsers connect only over HTTPS (checked on 22 October 2026). The database and file storage run on Lovable Cloud in the AWS eu-west-1 region (Ireland, EU). Data at rest is encrypted with AES-256 by that hosting infrastructure, according to the infrastructure provider's security documentation; Brimlo does not offer customer-held encryption keys. Lovable states that it holds SOC 2 Type II and ISO 27001:2022 certifications; they cover the infrastructure provider and are not an independent audit of Brimlo itself. Where AI requests are processed is set by the model provider and is not limited to the EEA.
Deletion, diagnostics and concerns
Income and expense records can be exported for Excel in the workspace, also after a plan ends; a full copy of your data or account deletion can be requested from the privacy contact. Deletion of active records and expiry of backups follow different processes, described in the Privacy Policy and DPA. AI chat diagnostics use content-length placeholders; monitor repair logs exclude full model responses and provider error payloads. These are application controls, not an independent security certification. Send privacy or security concerns to the contact in the Legal Notice.