People ask this three ways: what can it see, what does it keep, who can look at it. Each has a separate answer, and each has a page that changes it. ## The connectors it reaches A workspace reaches an account only once somebody connects it, and each account carries one level per connector. Google is one sign-in that carries mail, calendar and Drive, each with its own level, so an AI can read Drive without touching mail, or read mail and be unable to change a file. Mail runs **Off**, **Read**, **Draft**, **Manage**, **Full**. Calendar and Drive run **Off**, **Read**, **Full**. Each level includes the ones below it. [Permissions](/docs/tools/permissions) has the ladder and where to change it. **What Read stops.** At Read on a mail account, an AI can search the mailbox, read messages and threads, see the labels a message carries, and see which addresses the account sends as. It cannot write a draft, reply, forward, send, label, move, mark or trash anything. Those commands are refused, not hidden: an attempt names the level it needs and the page that changes it. **What Read is not.** The level is GBrain's own gate on the commands it hands an AI. When the account is connected, Google grants GBrain permission to read and to change mail, and the level is where GBrain stops its own commands from using the change half. Google's own permissions screen shows the wider one either way, so the level is the answer to what an AI may do, and not a change to the grant Google holds. ## Who may use an account Who else may use an account is a second, separate choice, made by whoever connected it, for each workspace. It has four answers: - **Team.** The workspace's own AI and everyone in it use the account without asking. Every account starts here. - **Ask me.** Each use waits for the owner's approval, by email and on the Approvals page. An approval lasts 90 days or covers one command, which lapses unused after 24 hours, and it allows reading unless the owner allows changes too. It ends when the person's membership does. - **Each person.** Nobody else's AI uses the account. A teammate's AI uses the teammate's own account of that kind, or is told to add one. - **Just me.** Only the owner's own AIs use it. The workspace's chats and schedules do not, and other members do not see it. Only the person who connected the account changes this. An admin cannot loosen it, and can only set the whole workspace to **Ask the owner**, which moves every Team account to Ask me and starts new ones there. [Who may use an account in a team workspace](/docs/workspace/who-may-use-an-account) has the approval page and each choice in full. The keys behind an account never reach the workspace. GBrain holds the sign-in and brokers each request, so a workspace that misbehaves cannot walk off with the Google account. Disconnecting the account destroys the credential GBrain holds. ## What a workspace keeps **Its memory.** Every note is a markdown file on the workspace's own disk, with the database underneath it, and anyone with Shell on can copy all of it out ([Move your GBrain out of a workspace](/docs/workspace/export)). Nothing is locked in a format only GBrain can open. **Its conversations.** Chat history and files dropped into chat are kept in GBrain's own database and file storage so the web page can show them, rather than on the workspace's disk. The account's Data export builds a copy of what GBrain holds about a person; the workspace's Data protection page builds one for the workspace. **What it did.** Every command an AI runs on a connected account is on the [activity record](/docs/tools/activity), under the connection that asked and on the account owner's page. **How long.** A workspace whose subscription ends stops, and nothing in it is deleted. GBrain keeps it for at least a year; after that, a workspace nobody has used gets an email to its admins 30 days before anything is removed. A person can delete an account, and an admin can delete a workspace, at any time. ## Who can read it The organization is the wall. Everyone who is a member of the organization the workspace belongs to can open it, read every note in its memory and every message in its chats. There is no per-note permission, no per-folder permission, and no private thread: a chat one member starts is readable by every other member. A second workspace in the same organization does not keep them out; a separate organization does. **An email domain can let people in.** An organization started from a work address lets anyone who signs up with that domain join it as a member. Its Members page says so when it does, and an admin can choose **Stop this** there, which keeps out everyone who would sign up after that; everyone already in it stays. So a workspace is only as private as its domain until somebody stops it. [A workspace for a sensitive team](/docs/workspace/sensitive-teams) has the rest. The workspace's Data protection page names each group that can read it, and each one is real: - **Members and admins** of its organization. - **An expert**, an outside partner an owner brought in to set it up. Experts are admins. - **Guests**, only where the workspace has guest chats. A guest reads through their own chat alone, and an admin can read that conversation. - **GBrain staff**, while they are in, explained below. - **Chat apps.** A workspace connected to Slack or Telegram answers whoever those chat apps let message it, whether or not they are a member, and each one's page in the workspace's Messaging says who that is. ### GBrain staff GBrain runs the servers, so it has operator access. What that means is written down rather than implied: - **Watching the service.** Request rates, latencies, errors, queue depth, machine health and the count and outcome of commands a workspace runs. That is the shape of the work, not its content. - **Opening a workspace.** Looking at a workspace from the staff console, reading its state or logs, running a command in it, or making oneself an admin of its organization. Each of these is recorded **before** it happens, with who, when, what and why, and the door stays shut if the record cannot be written. Rows cannot be edited or deleted. - **Reading the record.** The workspace's Data protection page lists every one of them for its admins, and the reason is quoted as the staff member wrote it. Recording began on 30 October 2026, so the page can only show what happened after that date. - **Outside the record.** Direct access to GBrain's servers and database, its background job queue, and its support AI reading GBrain's own records across every customer. The privacy page says these exist and are kept for outages and incidents. - **Asking not to be looked at.** A customer can say so, and GBrain notes it on the account. Some problems cannot be diagnosed from metrics alone, so the trade is real. [Privacy](/trust/privacy) section 4 is the same commitment in the policy's own words, and [Security](/trust/security) covers the rest. ## What leaves GBrain **The AI that does the thinking.** A workspace runs on one model, which an admin picks in its Settings, starting from Claude Sonnet 5.5 for a new workspace. Each call carries the prompt for that request to the company behind that model, and nothing else. The Data protection page lists where the workspace's calls went in the last 30 days: which provider, which host, which region and how many. **The other calls one turn makes.** A saved note is indexed for search by meaning with OpenAI's embedding model, and the same model turns a question into the vector it is searched with. A message the workspace files as memory is read by a small Anthropic model, to decide what to save. A workspace suspected of being broken can have a bounded, redacted window of its recent conversation read by a small Anthropic model to spot the failure. **Keeping it to what you approved.** On the Data protection page, **AI routing** set to **Only approved** limits a workspace to the destinations an admin approved, and GBrain refuses every other call before it leaves, embeddings included. Every connector also goes to its own company; [Subprocessors](/trust/subprocessors) lists each one GBrain sends anything to. **Where it sits.** The workspace's memory, its chats and its files are stored on Fly.io in Chicago, in the United States. GBrain is not end to end encrypted, and cannot be: the workspace reads its material in cleartext so a model can work on it. [A workspace for HR, legal or health data under GDPR](/docs/workspace/gdpr-sensitive-data) is the version of this page for data that needs more care. ## Personal, and a plan with the workspace's own AI A note saved is the same note either way: the same markdown file on the same disk, organized into the same folders, indexed for search by meaning. What differs is who writes and who tidies. Personal has no AI of its own, so the AI a person already uses writes the notes over the connection, and nothing runs in the cloud between visits. A plan with a workspace's own AI answers in Chats, runs scheduled work with every laptop closed, and tidies the memory overnight, which is what makes a workspace fed for a month answer better than a new one. [Which AI does what](/docs/workspace/what-runs-where) has each job and where it runs. ## Where to look Open the workspace's **Settings**, then **Data protection**, for where its data goes, who can read it, and every time someone at GBrain opened it. Open **[Approvals](/approvals)** for the four answers on each account connected to it.