How Braid handles your data

Braid connects to your company's OpenAI organization to report on what your AI use costs. This page explains what Braid reads, how it keeps the key you give it, who can see your data, and how to remove it. Questions go to hello@getbraid.app.

What Braid reads

Braid asks for an OpenAI Admin key with OpenAI's Read only permission. With it, Braid reads your organization's usage and cost (requests, tokens and dollars by day, project, API key and model) and the list of your projects and their keys. Of each key it keeps the name and the last characters OpenAI shows, never the key itself. It also reads OpenAI's list of Admin keys, to show when yours expires.

Braid never reads your prompts, your models' responses or anything else your requests contain. OpenAI's usage and cost data doesn't include them.

Braid's code can only send read requests to OpenAI, and only for the data above. It never changes your OpenAI account, its limits or its keys.

How Braid keeps the key

• You paste the key once, and it travels over an encrypted connection. Braid's server checks it with a few read requests, then encrypts it with AES-256-GCM before it reaches the database, so the database only ever holds the encrypted copy. The encryption keys are kept in the server's settings, not in the database.
• Braid never shows the key again: not in the app, in an email or in a log. The app shows only its last characters, as OpenAI does.
• Only Braid's server can open it, and only in memory.
• Disconnect, in Braid's settings, deletes the stored key at once and stops importing. What was already imported stays in Braid until you ask us to delete it.

Revoking the key in OpenAI

You can cut Braid off at any time from OpenAI itself. Sign in to OpenAI as an Owner of your organization, open Organization settings, then Admin keys, and delete the key you made for Braid. Braid can't read anything with it after that. Deleting the key in OpenAI doesn't remove what Braid already imported: Disconnect in Braid, or ask us to delete your company, for that.

Who can see your data

• Your company's people in Braid. Each sign-in belongs to one company and sees only that company's data. Your admins manage the OpenAI connection, the company budget and who gets the report.
• Whoever has a report link. Each weekly report email links to the full report, and anyone with that link can open it for 90 days. Your admins choose who receives the report, and can turn report links off, which stops every link from opening.
• Braid's founder, who runs the service and can reach its database to keep it working and to help when you ask.

Website analytics run on this site only. The Braid app and its reports carry none.

Deleting your data

Ask us at hello@getbraid.app to delete your company, and we'll delete everything Braid holds for it: the OpenAI connection and its encrypted key, imported usage and costs, Implementations, budgets, reports, findings and alerts, and the Braid sign-ins of the people still in it. Copies in backups made before the deletion are kept until those backups expire, and our email provider keeps its own record of the emails it sent for a limited time. Delete Braid's key in OpenAI as well, as above.

Where your data is hosted

Braid's database and sign-in run on Supabase. The Braid app and this website run on Vercel. Report and alert emails are sent through Resend. Our Privacy Policy covers the rest of what we collect and why.