Question 1

What data does Borrow Brains hold about my company?

Accepted Answer

We hold the data your engagement needs to run: project and account details, the communications between us, and the deliverables we build together, and nothing beyond that scope. Each engagement gets its own inventory of what we hold, kept in your working folder from day one and available to you on request. We do not accumulate data beyond what the job in front of us requires.

Question 2

Where does it live?

Accepted Answer

Most of what we run sits on EU-region services and on infrastructure we self-host and operate ourselves, not a third party's shared cloud. For engagements that involve your own communications or documents, we can run the work zero-egress, entirely on hardware you control, so nothing leaves your premises. Which setup applies is agreed with you before the work starts, not after.

Question 3

Do you sign a DPA?

Accepted Answer

Yes. A data-processing agreement is standard practice for any engagement that touches your data. We have built client trials that only opened once a signed DPA was in place, before a single record moved. If you need the DPA before you can approve a project internally, ask early; it is part of how we scope the engagement, not an afterthought.

Question 4

What reaches AI model providers?

Accepted Answer

Only what the specific job needs, and no more. Deployments that work with your internal communications keep that corpus local rather than sending it to a model provider. Where a provider is used, we name it in the engagement documentation, so you know exactly what touched your data and where. Nothing reaches a provider by default; every path is scoped to the job.

Question 5

Can my data train someone's model?

Accepted Answer

No. We do not permit client data to be used to train a provider's model, and that position is part of the data-processing agreement conversation before work begins. Where a provider's standard terms would allow that use, we address it in the agreement rather than accept it by default. Your data is used to do your work, not to improve someone else's product.

Question 6

Who are your subprocessors?

Accepted Answer

Subprocessors are named per engagement, in the annex to the data-processing agreement, rather than on one public list meant to cover every client regardless of what they actually need. That way the list you see reflects the services genuinely touching your data. Ask at the start of an engagement and you will have the current list before anything moves.

Question 7

How long do you keep things?

Accepted Answer

Retention is set out in the data-processing agreement for each engagement, and we delete on request. Where a trial or pilot is running, consent and retention controls are built into the system as code, not left to a policy document alone, so what happens to data is enforced rather than promised. Ask what applies to your engagement and we will confirm the specific terms.

Question 8

What happens when an engagement ends?

Accepted Answer

You keep everything. The code, the data, and the results we produced together stay yours when the engagement closes, the same way they were yours while it ran. That is the model behind Borrow Brains: you borrow the capability, you do not rent an outcome that disappears if you stop paying. Nothing is held back or degraded once the work is done.

Question 9

How do you secure your own operation?

Accepted Answer

We run our own operation under the same discipline we sell. Credentials sit in a self-hosted vault, servers accept key-only SSH rather than passwords, and actions that reach outward, such as sending a message or moving data, wait behind an approval gate. We do not ask a client to accept a standard of discipline we do not hold ourselves to internally.

Question 10

Do AI systems act on their own?

Accepted Answer

No. Anything an automated system drafts, whether a reply, a report, or a change to a live system, waits for a person to approve or edit it before it goes anywhere. That approval queue is not a policy statement; it is how the systems are built to run. We treat this as the baseline for any automation we ship, not an optional safeguard.

Question 11

What about cookies and analytics on this site?

Accepted Answer

This site carries no advertising trackers. At most one consent-based analytics tool runs, and only after you accept it; fonts and other assets are self-hosted or served from our own domain rather than pulled from third parties. If you decline analytics, the site behaves exactly the same. See the cookie policy for the current detail.

Question 12

Which legal entity is responsible?

Accepted Answer

Borrow Brains is operated by Innsikt Holding AS, a Norwegian company, org. nr. 935 861 993, based in Oslo. Innsikt Holding AS is the data controller for this site and the contracting party for engagements. Data-processing agreements are signed with Innsikt Holding AS.

Question 13

Who do I ask?

Accepted Answer

Write to contact@borrowbrains.com. A person who works on the operation reads and answers, not a support queue or a script. If your question needs the underlying legal document, the data-processing agreement, or a specific answer about your engagement, ask there and you will get it directly.

Your data, in plain language.