Every company brain answers to the company. None of them answer to the person. That gap is the whole opportunity.
BrainAlly · Market thesis · August 2026
The problem
Company brains inherit a mess they did not make.
16% of business-critical data, already overshared
Over 800,000 files per organization sit exposed right now, most carrying wrong sensitivity labels or none at all. This is true before any AI is installed.
Gartner calls the failure mode oversharing risk. Retrieval does not create permission debt. It executes it, instantly, at every desk in the company.
The category looks decided
Well funded, growing fast, and pointed at the wrong authority.
$7.2BGlean's valuation, on $300M ARR growing 89% a yearSeries F · Sequoia, Lightspeed, Wellington
30MPaid Microsoft 365 Copilot seats, doubled in six months15M Jan → 20M Apr → 30M Jul 2026
60%Of the Fortune 500 running 10,000+ Copilot seatsAccenture alone: 740,000
And they are not careless about permissions. Glean mirrors every source system's access list at crawl time, then enforces it at query time against the signed-in user, per document, per field, in places per sentence, outside the model rather than in the prompt.
It is well built. There is simply only one authority in the system, and it belongs to the company.
The gap
Two authorities. Only one has ever been built.
Authority one · shipped
The company's file permissions
What IT and document owners granted. Inherited wholesale from Drive, SharePoint, Slack, including every mistake already in them.
Authority two · unbuilt
The individual's grant
What the person actually chose to share, scoped and revocable, with an audit log they hold. Nobody ships this as a product primitive.
Both must be satisfied. Where they conflict, the person wins.
Why all three
Consent cannot be retrofitted.
Digital Twin→Personal Brain→Company Brain→Self-Learning AI
A company brain assembled top-down has nothing to grant from. There is no individual layer, so there is no second authority to add later. The inner rings are not features we hope to reach. They are how you construct a brain that has one.
An employee will also not trust a company brain before their own twin has done something useful for them. So the build order follows the trust order, from the core outward.
The brain belongs to the company. The twin belongs to the person.
The landscape
Three crowded markets. One empty column.
Segment
What it does
Answers to
Who
Enterprise search
Retrieval across company systems
The company
Glean, Copilot, Hebbia, Dashworks
Personal AI & twins
A persona or memory for one person
The vendor
Personal AI, Delphi, HeyGen, Tavus, Limitless → Meta
Consent infrastructure
Compliance proof for consumer data
The company
OneTrust, Transcend, Ketch
BrainAlly
Retrieval governed by two authorities
The company and the person
unclaimed
Personal AI is closest, at roughly $22M raised and already selling “sovereign digital twin” to enterprises. They own the language. Nobody yet owns the enforcement point, which is retrieval.
Why now
The deadline already passed.
EU AI Act high-risk obligations take effect for employment AI. Recruitment and HR management become high-risk categories, with duties landing directly on the employer. It sits on top of GDPR, not instead of it.
California becomes the only state fully extending privacy rights to employee data. Workers can demand access, correction, and deletion of their workplace record.
Limitless is acquired by Meta. Rewind shuts down on 19 December. Users who spent two years building a personal memory lose it, having never held the keys.
California AB 2602 requires consent before an employer may use an AI replica of a worker's voice.
The market
Growing fastest exactly where the gap sits.
Segment
2026
Forecast
CAGR
GenAI in enterprise knowledge & search
$7.81B
$27.4B by 2031
28.6%
Knowledge management software
$16.2B
$37.6B by 2031
18.3%
Enterprise knowledge graph
$3.5B
$13.4B by 2033
21.3%
Enterprise search
$7.47B
$11.7B by 2031
9.3%
Mid-market deployments run $40K to $150K. Knowledge workers recover a median 6.4 hours per week, roughly $100 to $200 per seat in absorbed time.
The strongest objection
“Personal data vaults have been tried. Solid has existed since 2016 and never won. Why would this be different?”
Fair, and the documented reasons it stalled are structural: network effects favour whoever already holds the data, nobody gets paid to integrate a personal cloud, and path dependence kills third-party adoption.
Solid asked individuals
We enter through the enterprise. The company buys the brain.
Solid had no payer
The vault arrives as infrastructure, not as a thing to go adopt.
Solid had no deadline
A regulator set ours, and it passed on 2 August.
Solid needed federation
We only need the retrieval layer, which we control.
What we build first
Enterprise-first. Individual-in.
Pre-product today. Nothing exists beyond this thesis and a landing page. The substrate is chosen: we extend gbrain, MIT licensed, whose markdown-in-git plus Postgres and MCP design is already the canonical answer to lock-in. We are not reinventing retrieval. We are building the authority above it.
01 · Digital Twin
One team inside one design partner. A structured model of what each person knows and decided, with the vault and its grant, revoke, and audit log from day one. Consent is built first or it is never built.
02 · Personal Brain
The twin starts doing work that needs their context, so the individual has a reason to keep it current. This is where retention is proven or the thesis fails.
03 · Company Brain
Only once enough twins exist to aggregate from. Every answer carries its citation and its original permission boundary, because it was assembled that way rather than filtered afterwards.
What we are looking for
One design partner in the EU or California, where the compliance deadline is already real, and one team inside it willing to run the twin for a quarter.
Market forecasts are third-party analyst estimates and should be read as directional, not as a bottom-up model. BrainAlly is pre-product: this document contains no revenue, pilot, or customer claims, because there are none to make.