Compliance
Audits and data protection
In progress
ISO/IEC 27001. The international standard for running an information security management system.
In progress
SOC 2 Type II. An independent audit of how we keep customer data secure, over a period of months.
GDPR. The application and its data are hosted in Switzerland, and the models run in Europe.
No model training. Your documents are read when a question needs them. No model is trained on them.
Hosting
Where Cobrain runs
Microsoft Azure
Google Cloud
Models
FoundryEU data zone
- GPT 5.5
- GPT 6 Sol
- GPT 6 Luna
- Mistral Large 3
- DeepSeek V4 Flash
Vertex AIEU multi-region
- Claude Fable 5.1
- Claude Opus 5.5
- Claude Sonnet 5
- Claude Haiku 4.5
- Gemini 3.8 Flash
ApplicationZurich
- Web app
- Backend
- Agent
DataZurich
- Database
- Tables
- Files
- Backups
SandboxZurich
- Code the agent runs
- Attachments
Microsoft AzureApplication, data and sandbox, Zurich
Google CloudVertex AI, EU
Microsoft FoundryEU data zone
Google's EU endpoint keeps processing inside EU member states and may answer from any of Google's EU regions. The pin marks europe-west1 in Belgium. Foundry has no pin because its EU data zone is not one place. Microsoft may process a request in any of its Azure regions in the EU, Norway and Switzerland.
How access works
Closed folders stay closedA folder you cannot read is missing from the file tree, from search and from what the agent can see.
The agent acts as youEvery turn runs as the person who asked, and every read is checked against that person's access.
Tokens stay with the applicationThe agent names an action and the application calls the vendor. A token never reaches the sandbox or a transcript.