The questions a company asks before it trusts us.

One brain your company owns: pages of markdown that every AI you connect can read. A sync client keeps the brain on your devices as plain files, the brain serves it to your agents over MCP, and for each page you choose whether our server can read it. You keep feeding it, and every model you hire later starts with everything you taught the ones before.

Any MCP client that speaks Streamable HTTP: Claude Code, Codex, Cursor, ChatGPT, Claude on the web or on your phone, a bot you built — and the ones that do not exist yet, because MCP is an open protocol and the brain speaks it to every agent. A client adds one entry to its MCP config and signs in once. Writing is a second approval, separate from reading.

Yes. Each agent connects on its own and reads the same brain, so Claude Code, Cursor and ChatGPT can all work from the same pages on the same day. Each one signs in separately, and you approve writing for each one separately. Change which AI you use, or add another, and the brain stays as it is.

No. The sync client turns every page your keys open into a plain markdown file, so your editor and Claude Code read the same files they read today. The only thing it adds to a file is a short header: id, scope and key_id. Day one shows the whole first day.

What only one person knows today: the pricing floor and who can approve an exception, why a deal was declined, the fix that worked last time, the reason a schema looks wrong, the naming rules. Decisions and their reasons, not your file store. Use cases goes team by team.

It distils them. You connect the sources, your AI reads them and writes a structured brain: not an index of the sprawl, but pages your team reviews and corrects before an agent relies on them. A folder of markdown you already have is adopted as it is.

It depends on the area, and you choose it per page. We hold an open-area page as markdown and can read it; that is what lets an agent with no key reach it. A secure-area page is encrypted on your device before it leaves, path included, and padded into size buckets; we hold ciphertext and cannot read it.

Yes, when it reads them. An agent that reads a file sees what the file says, secure-area pages included. “Our server cannot read it” and “no system anywhere sees it” are different claims, and only the first is true of any product that involves a model.

A breached, seized or rogue-admin host gets ciphertext for the secure area, and the open area as markdown. Some metadata leaks either way: scope names, ids, counts, size buckets and timing — so a scope named layoffs tells us there is a scope named layoffs. The security page lists every residue.

ChaCha20-Poly1305 for content, X25519 with ML-KEM-768 to wrap scope keys, HKDF-SHA256 to derive a key per node, Ed25519 to sign membership, and Argon2id for the recovery passphrase. Every primitive ships with Node 24, so there is no third-party crypto dependency.

Yes. Every write carries the signature of the device or agent credential that made it, so the brain records who wrote a page and refuses one from a credential you never admitted. Reader control is signed the same way, in the membership chain.

On your device, in its own keystore: the Keychain on a Mac, the TPM on Linux and Windows. Our server stores only scope keys wrapped for each device, and none of what it stores opens a page.

On servers in Europe that we rent; the provider holds the disks, and for the secure area those disks hold ciphertext. The company is in the United States. Nightly database dumps are kept by us alone, newest fourteen. The privacy policy names every party that touches data.

instibrain key backup seals the device keys under a passphrase into one file you keep off the machine, and key restore rebuilds a wiped device from that file alone. Lose every device and the backup, and nobody can open the secure area, us included.

You keep the folder: every page your keys open is already a markdown file on your devices. The contract only grows inside /v0, and every sync client and the protocol package are open source, signed and reproducible. What you keep has the detail.

Yes. Write to privacy@webwork.ai and we delete the account and its data. Nightly backups keep fourteen days, so a deletion takes up to about two weeks to age out of them.

Yes. One brain serves the company, and every page carries a scope: team scopes everyone reads, per-person scopes for one seat, private scopes you keep alone. In the secure area a scope is a key only the admitted devices hold; admitting a reader is a signed entry, and so is removing one.

Yes. Each agent connects with its own credential and signs every write it makes, and the access log in the cockpit shows which agent read or wrote which page. Agent definitions are pages in the brain too, so every agent improves when the brain does.

We open one brain per company, for a named person there. Getting access says what comes with an account and how to ask.

The parts that touch your keys are. Every sync client and the protocol package ship open source, signed and reproducible, so you can verify the copy you run. The server stays closed and we operate it.

No. The server stays closed and we operate it. The sync client and the protocol package are open source, so the parts that hold your keys and speak the contract are the parts you can read.