Some material should only reach a few people: personnel files, a legal matter, board papers. GBrain keeps that material apart by giving the team a separate workspace in a separate organization, with only that team in it.
There are no per-folder permissions. Inside a workspace, and across every workspace in one organization, every member can read the memory and the chats. That is what lets a team share one memory without thinking about it, and it is why the wall goes around the organization, not around a folder.
The organization is the wall
Who can open a workspace in GBrain is decided by who is a member of its organization. A few other ways in are listed below, under Other ways in.
- Every member of an organization can read every workspace in it. A second workspace in the company’s organization does not keep the rest of the company out.
- A separate organization does. Someone who is not a member of it cannot open its workspace, its chats or its memory in GBrain, and cannot tell it exists.
- Admins are members too. They also change its settings and decide who is in it.
So a sensitive team gets its own organization, and only the team joins it.
Set it up
- Make a new organization. From your account, open Organizations and choose New organization. Name it for the team, for example “Acme HR”. You are its first admin.
- Add a workspace to it. Start the workspace from inside the new organization, so it is billed to and reached through that organization.
- Invite only the team. In the organization’s Members, add each person by email. An invitation works only for the address it was sent to. Skip invite links, or keep one that asks an admin before anyone joins: a link set to let in everyone at a company’s email domain lets the whole company in.
- Leave chat apps off. Do not connect Slack or Telegram to it unless everyone those apps let message it belongs on the team.
- Check who can read it. Open the workspace’s Settings, then Data protection. It lists each group that can read the workspace, with how many people are in each, and the chat apps connected to it.
Someone who leaves the team is removed from the organization’s Members, and their access ends there.
Who can read it
The workspace’s Data protection page names each group, from the same records that let people in:
- Members and admins of its organization: its memory and its chats.
- An expert an owner brought in to set it up. Experts are admins, so they are counted with the admins, and admins see them by name.
- Guests, only if the workspace has guest chats. A guest reads only through their own guest chat and changes nothing, and a guest chat can be set to not read the memory at all.
- GBrain staff, when they add themselves as an admin to support the workspace. Each time is recorded, and while they are in they show on the page like any other admin.
Other ways in
- Chat apps. A workspace connected to Slack or Telegram answers whoever those apps let message it, and it can tell them anything it knows, whether or not they are members. Each app’s page in the workspace’s Messaging says who that is.
- Guests. A workspace with guest chats lets each guest in through their own link, as described above.
- A guest’s own conversation is the one thing members do not all read: only that guest and the workspace’s admins can.
Bring material in by copying it
The team’s workspace starts empty, and nothing flows into it from the company’s other workspaces. Material moves only when someone copies it:
- Add the documents themselves, in the team’s workspace chat or its memory. See Memory.
- Start from a snapshot. If the team needs what another workspace already knows, fork that workspace into the team’s organization. The fork is a copy taken once; the original is not linked to it afterwards.
Nothing in the sensitive workspace flows back out either, unless a member of it copies it somewhere.
Coming next
A record of staff access. Each time someone at GBrain, or GBrain’s support AI, opens the workspace, it is recorded first, with who, what and why. The organization’s admins read it on the workspace’s Data protection page.
These are being built for workspaces like this one. Each is not available yet, and this page will say how to turn it on when it is:
- Approved models only. Limit the workspace to the AI providers and model endpoints an admin approves, for example ones that process data in the EU.
- Owner approval for colleagues’ accounts. A teammate’s connected account, such as their email, is used by the workspace only once that person approves.
What it does not do
- Hide one folder or one workspace chat from someone who is a member.
- Keep a second workspace in the same organization private from that organization’s members.
- Copy anything between organizations on its own.