For educators and workplace teams
Security and data handling.
BrainFusion is a browser-based practice tool. Review what you plan to upload, what session results can show, and your organisation's requirements before using it with restricted information.
Reviewed November 12, 2026. This page describes current service behaviour and procurement questions. It is not a security certification, data-processing agreement or guarantee that the service meets every organisation's requirements.
What information does the service use?
- Creator accounts: sign-in information, created content, games, sessions and relevant billing records. Learners do not need creator accounts to join a shared game.
- Scored gameplay: self-entered display name, score, maximum score, optional duration, submission time, game type and question-response details supplied by the game. Names are not checked against an employee or school roster.
- Service and usage information: operational request information and analytics used to operate and improve the service. Optional Google Analytics loads after analytics consent. Account-free participation does not mean that no data is processed.
Display names, questions and answers can contain personal information. Use an appropriate nickname convention, avoid sensitive content, and share session codes only with the intended group. Read our privacy policy and reporting limitations.
Hosting and transfers
The production application runs on Amazon Lightsail in AWS region us-west-2 (Oregon, United States), verified for this review. Third-party features may involve separate processing locations. This is not an EU-only hosting or data-residency commitment.
Before uploading regulated, confidential or restricted material, ask for the current hosting, transfer and contractual information your organisation requires. Use only content approved for the service.
Third-party services
- Amazon Web Services: production application hosting.
- OpenAI: AI-assisted generation, when used. Material submitted for generation is sent to its API; manual question entry is an alternative.
- Stripe: payment processing. BrainFusion does not store full card details.
- Resend: transactional email.
- Google: optional Google sign-in and consent-based Google Analytics.
- Cloudflare Turnstile: bot protection on forms where enabled.
This describes feature-specific service use, not contractual subprocessor terms. Ask for current provider, location and agreement details before a procurement decision. One provider's retention or training policy should not be assumed to apply to every feature.
Access and protection
The public service uses HTTPS. Creator accounts authenticate access to game management and session reports; report and export requests check session ownership. Account passwords use hashing instead of readable password storage.
Learners enter a session code and display name without a learner login. Reports do not verify identity, individual attendance or certification. Shared-device answers cannot establish each person's understanding. No security control eliminates all risk.
Retention, deletion and exports
Our privacy policy states that account data is retained while the account is active and directs deletion requests to support. It also explains that gameplay information may be retained in aggregate form. Report visibility, session expiry and deletion from a screen are not promises of immediate removal from all systems or backups.
We do not publish a fixed backup-expiry or deleted-data removal deadline here. If your organisation requires a specific period, contact us to confirm it before use. Provider-side retention and your organisation's retention of exported files are separate matters.
Trainers can print reports and export sessions as .bfsess files. Protect those files under your organisation's access and retention process. Downloading them does not create a verified compliance record.
Questions or a security concern?
Contact support@brainfusionlearning.com about data handling, deletion, procurement requirements or a suspected security issue. Describe the issue without sending passwords, API keys, card data or unnecessary learner information.
Contact BrainFusion or return to corporate training.