PLATFORM · PRIVACY AND GOVERNANCE REVIEW
Evaluating GDPR compliant AI? Review source permissions, workspace access and processing terms together, with your organization’s privacy requirements in view.
Which sources can this role access?
Review the selected sources, workspace membership and access rules together. Compare the answers available to people with different roles. 1
Review source permissions
Can sales see employee records?
Check the employee handbook separately from restricted HR documents. Use the intended roles to verify which sources each person can open. 1
Check workspace boundaries
What activity can our admins review?
Review the activity records available to your administrators. Check the recorded fields and retention settings for your workflow. 1
Inspect access records
How is company knowledge processed?
Read the published privacy policy and the terms for the model provider your workspace uses. Review data use, retention and applicable contractual documents before adding sensitive information. 1
Review provider data terms
Your legal and compliance share answers with sources.
Legal
Which sources can this role access?
On request
Which source collections and workspace roles should we compare?
Before deciding
Source answer: Review the selected sources, workspace membership and access rules together. Compare the answers available to people with different roles.
Sources: Review source permissions (Google Drive); Marlow Works · Supporting notes (Notion).
Compliance
Can sales see employee records?
Weekly
Which roles can read the handbook but not the restricted HR material?
Before deciding
Source answer: Check the employee handbook separately from restricted HR documents. Use the intended roles to verify which sources each person can open.
Sources: Check workspace boundaries (Notion); Marlow Works · Supporting notes (Google Drive).
IT
What activity can our admins review?
On request
Which activity fields and retention settings can administrators review?
Before deciding
Source answer: Review the activity records available to your administrators. Check the recorded fields and retention settings for your workflow.
Sources: Inspect access records (Google Drive); Marlow Works · Supporting notes (Notion).
Leadership
How is company knowledge processed?
Weekly
Which model-provider terms apply to data use and retention?
Before deciding
Source answer: Read the published privacy policy and the terms for the model provider your workspace uses. Review data use, retention and applicable contractual documents before adding sensitive information.
Sources: Review provider data terms (Notion); Marlow Works · Supporting notes (Google Drive).
Legal
What can this agent access?
On request
How do we test allowed, restricted and revoked access for this key?
Before deciding
Source answer: Give the agent its own key and a defined knowledge scope. Test an allowed request and a restricted request, then check what happens when the key is revoked.
Sources: Scope an AI agent (Google Drive); Marlow Works · Supporting notes (Notion).
Compliance
Where can we review processing and transfer information?
Weekly
Where are the published provider, transfer and privacy-contact details?
Before deciding
Source answer: The published privacy policy describes providers and international transfers. Contact the listed privacy address for the contractual information your organization needs.
Sources: Review processing locations (Notion); Marlow Works · Supporting notes (Google Drive).
Collect selected-source, membership and access-rule details before comparing roles.
Review those details together and compare the answers available to people with different roles.
Check employee-handbook access separately from restricted HR documents.
Use the intended roles to verify which handbook and HR sources each person can open.
Locate administrator activity records, then collect the fields and retention settings for review.
Review the available activity records and check their recorded fields and retention settings for your workflow.
Collect the privacy policy and model-provider terms before reviewing company data use.
Read the published policy and your provider’s terms, then review data use, retention and contractual documents before adding sensitive information.
ONE CONNECTED BRAIN
Bring Google Drive, Notion and your uploads into one cited answer.
FOLLOW THE SOURCE
Open the citation. Read the original wording and surrounding detail.
PERMISSIONS IN EVERY ANSWER
Compare allowed and restricted requests, their sources and activity records.
Use our privacy policy to review data handling, providers and international transfers. For contractual documentation, contact legal@heybrain.io. Evaluate these documents alongside your organization’s purpose, source collection and chosen model provider.
Answers respect source access.
Set its scope. Revoke its key.
Review requesters, sources and access decisions.
Check provider data use and retention.
Connect your model to governed knowledge.
Review data handling, providers and international transfers.
Read the privacy policyLESS CONTEXT. LOWER COST.
HeyBrain sends only the context a task needs.
FAQ
Review the selected sources, workspace membership and access rules together. Compare the answers available to people with different roles. Ask follow-ups in the same conversation and open each citation to check the surrounding detail, then share the source with colleagues who can access the same collection.
Check the employee handbook separately from restricted HR documents. Use the intended roles to verify which sources each person can open. Connect the relevant Drive folder or Notion pages, or upload documents, then follow citations to their original passages from the AI tools your colleagues already use.
Review the selected source collection, workspace members, agent scopes and model provider together, including processing terms, retention and the records available to administrators. Use the published privacy policy and request any contractual documents your organization needs. Assign an owner to each unresolved question before expanding the source collection.
Use approved test documents and accounts with different roles and compare an allowed question with a restricted request, open the cited sources and review the resulting activity records. Repeat the check after a membership or permission change. Include source links and document reads, so the review covers more than the answer text.
Connect your team’s current brief, decision notes and working guide, invite the people who need them and ask a familiar question. Open its source citations before expanding the collection. Align workspace membership and individual agent scopes with each team’s responsibilities.
Start with the published privacy policy for data handling, providers, international transfers and the privacy contact. Review your organization’s purpose and chosen model provider alongside those documents before adding sensitive data. Record which terms apply to each connection and who will review changes to that workflow.
/ Get started today
