Brrainy

Architecture

How Brrainy works under the hood

A production stack - Postgres RLS, Neo4j graph, pgvector hybrid search, object storage, MCP agents, and five client surfaces.

The stack

Follow one capture through the system

Not a laundry list of tools - a path. Something you save on mobile or in Cursor lands in the same space-scoped memory your briefs and agents read from.

  1. 1

    You capture

    Signal enters from every device you already use.

    Web app, desktop agent, mobile share sheet, browser AI chats, and IDE selection.

    • Web
    • Desktop
    • Mobile
    • Browser
    • IDE
  2. 2

    We authenticate & route

    Every request carries who you are and which space you are in.

    API gateway applies auth, rate limits, and space context before any service runs.

    • Auth
    • Space context
    • Rate limits
  3. 3

    Your brain does the thinking

    Capture is stored, linked, analyzed, and delivered - without you searching.

    Memory, ingest, integrations, and brain services share one permission boundary.

    • Memory
    • Ingest
    • Integrations
    • Brain
  4. 4

    State stays isolated

    Rows, graph nodes, and files are scoped to the space - enforced in the database.

    Postgres RLS, Neo4j, pgvector, Redis, and object storage under one tenancy model.

    • Postgres RLS
    • Neo4j
    • pgvector
    • Object storage
  5. 5

    Agents get the same memory

    MCP hands Cursor, Claude, and partners the context humans already trust.

    Search, assemble, and capture-push - still gated by your space permissions.

    • MCP
    • Context assemble
    • Ask-brain

Managed cloud by default. Same boundary model if you later point inference at your own key - see Bring your own key below.

Architecture pillars

Space-scoped RLS

Space isolation at the database layer. Every query filtered by space_id with withSpaceContext and X-Space-Id.

Hybrid graph + vector

Neo4j entities plus pgvector embeddings per space. Hybrid search assembles context via memory-service and MCP assemble.

Object storage abstraction

Pluggable S3, R2, B2, or in-memory providers. Service callers never import cloud SDKs directly.

MCP / agent platform

Hosted brain_recall and brain_remember tools plus guided prompts for Cursor, Claude, and partner agents - the same memory humans use, inside the linked-space permission boundary.

Bundle SDK (WASM + dylib)

Desktop WASM and native dylib hosts; mobile WASM-only. Ed25519 signatures, capability gating, and idle budget enforcement.

Your own models

Bring your own provider key, or point us at your own endpoint - including a local runtime. Chat, embeddings, reranking, OCR, and speech all honor it.

Bring your own key

Keep the memory. Choose who pays for the model.

Brrainy is the memory and the thinking on top of it. Inference can run on our credits, or on a key / endpoint you own - including a machine on your desk. Either way, the same space isolation applies.

Default

Run on our credits

Sign up and start. We operate models, scaling, and updates. Usage comes from your credit wallet.

  • Instant start
  • No keys to manage
  • Models tuned per task
BYOK

Your control

Run on your own key

Attach a provider key or custom endpoint. Chat, embeddings, OCR, and speech resolve through it - keys encrypted and scoped to that space.

  • OpenAI, Anthropic, DeepSeek, custom URL
  • Or a local runtime on your network
  • Chat, embeddings, OCR, speech all honor it

When you attach a key, a model call looks like this

  1. Your space

    Chat · brief · MCP

  2. Brrainy

    Routes the call

  3. Your key

    Encrypted at rest

  4. Provider

    OpenAI · Claude · local

Stays the same

  • Captures, graph, and briefs stay in your spaces
  • Space-scoped RLS and permissions unchanged
  • MCP agents still read the same memory

What changes

  • Token spend hits your provider bill (or local GPU)
  • You pick OpenAI, Anthropic, DeepSeek, custom URL, or local
  • Key is encrypted and scoped to the space you attach it to
See pricing

Security model

RBAC with resource-scoped permissions across user, service, integration, partner, and agent principals. Space-scoped row-level security, audit trails, GDPR export and erasure, and dual-approval for sensitive operations.

  • JWT + OTP + OAuth sign-in
  • Space-scoped isolation on every query
  • Audit trails and GDPR export / erasure
  • Encrypted credentials and secrets at rest
  • Prompt-injection defense on ingested content
  • Platform staff gates scoped to platform spaces

Get started

Built to be inspected

Read the architecture decisions, or start free and see it run.

Start freeRead the ADRs