For the contact form you already have
Your contact form should land somewhere other than your email.
Right now it emails you — so every inquiry your business has ever received is sitting in an inbox in plain text: searchable, forwardable, readable by anyone who gets in. Brun is what happens after someone hits submit instead. Their browser locks the message before it sends, we store a sealed envelope we have no key to, and it opens on your board as a lead. Breach us, subpoena us, bribe us: your inquiries, leads, and notes stay gibberish.
Self-serve · Firm $100/user/mo, 3-user minimum · 30-day money-back guarantee
A readable inbox is a copy of your business in someone else’s hands.
Your email provider. The form widget’s staff. The CRM vendor’s “AI insights.” Whoever breaches them next quarter. When a nervous prospect types the thing they’d only tell you — a matter, a diagnosis, a candidate’s name — an ordinary form hands a readable copy to people neither of you has ever met.
- Who can read an inquiry
- Vendor + staff + AI
- What a breach exposes
- Readable records
- What a subpoena to the vendor returns
- Readable records
From their browser to your board. We never hold the key.
Three steps. The envelope is only ever open at the two ends.
Step 1 · In their browser
Sealed in their browser.
A visitor fills out the contact form you already have. Before anything sends, their browser locks the message shut. Their device seals it — only your team’s key can open it.
Step 2 · At our door
Screened. Never opened.
Think of a bouncer who checks IDs but never opens envelopes. We confirm the sender is your site, run your spam checks, block replays — and then file the envelope shut. The block on the right is a real one, exactly as it sits in our database. No name. No message. Nothing to read, sell, train on, or hand over.
We store gibberish.
stored on our serversEncrypted so we can’t read it: every inquiry, lead, and note. Server-readable to run the service: your account and team email addresses, billing status, seat counts, timestamps, and any support messages you send us.
Step 3 · On your board
Unlocked on your board.
When you open your inbox, the inquiry is decrypted on your device — the one place the key exists. It lands on your board as a lead you can note, assign, and move from New to Won.
Nothing on your page can decrypt data. The only identifier a visitor’s browser ever sees is a public intake handle, worthless without your team’s key. Full mechanics →
The setup
Two changes. Your form, your design.
Keep the form you already have. Point its action at your private intake URL and add one script tag — it encrypts each submission in the visitor’s browser. Your fields, your design, no Brun branding, no rebuild. Not technical? Paste the two lines into the AI assistant you already use and tell it to update your contact form — that’s the whole install.
- <form action="/your-old-endpoint">
+ <form action="…/public/intake/your-handle">
+ <script src="…/intake.js">Then it’s just a CRM. A deliberately small one.
Once an inquiry is open, it needs somewhere to go. Brun gives it a board, a lead page, notes, a calendar, and a team — and stops there.
The board is the pipeline.
Inquiries land in an inbox, then move from New to Won.
Every decrypted inquiry becomes a lead — name, contact, message, source. No custom fields or pipelines to configure first. Drag a card to move it from New to Won.
Worked by recruiters, lawyers, therapists and coaches, brokers and financial advisors, and founders and consultants running their own sales. Don’t see yours? See your industry.
Inquiries arrive sealed.
A drop-in script encrypts every contact-form submission in the visitor’s browser, before it reaches us. They wait in your inbox as envelopes; your browser does the unlocking — nothing is decrypted anywhere else.
One page per lead.
Contact info, notes, and history. All encrypted in your browser. Assigned owner, encrypted notes, full history. A one-time key you save when you sign up. It’s how your team gets back in if someone forgets a password.
Bookings land sealed too.
Share a booking link and appointments land on your calendar, sealed like everything else. One click turns a booking into a lead — New to Won. Firm and Compliance plans; encrypted file attachments on intake are rolling out.
A team, not an org chart.
Invite teammates by email. Three roles: owner, admin, staff. Your plan sets the seat ceiling. Upgrade when you outgrow it. Stripe portal. Change seats, update your card, cancel — on your own, any time.
The same inquiries. A different threat model.
| Brun | Typical SMB CRM | Enterprise CRM | |
|---|---|---|---|
| Who can read an inquiry | Only your team | Vendor + staff + AI | Vendor + staff + admins + IT |
| AI training on your data | Never (we can’t) | Often opt-out only | Often opt-out only |
| What a breach exposes | Ciphertext only | Readable records | Readable records |
| What a subpoena to the vendor returns | Ciphertext only | Readable records | Readable records |
| Setup on your existing form | 2 changes | Embed / rebuild | Integration project |
What we left out. On purpose.
No AI. No email sync. No Zapier, no webhooks, no API. No mobile app. Not a roadmap — a promise.
Why leaving things out is the feature
Every one of those is a door your data could leave through, and we don’t build doors we can’t lock. Encrypted file upload on intake is rolling out; it’s the rare addition that survives that test. If one of the missing pieces is a dealbreaker, Brun isn’t your tool — we’d rather you know before you pay us.
- No AI.No summaries, no suggested replies, no “insights.” Your notes stay your notes.
- No email or calendar sync.Brun doesn’t connect to Gmail, Outlook, or your calendar.
- No third-party integrations.No Zapier, no webhooks, no public API.
- No mobile app.The web app works on a phone. That’s it.
- No custom fields.The lead form is the lead form. Everyone’s CRM looks the same.
- No automations.No triggers, no drip sequences, no assignment rules.
This is the whole product. It won’t get bigger.
The questions we get before every signup.
How do encrypted website inquiries actually work?
When someone submits your contact form, a small script encrypts the message in their browser before it’s sent. Brun receives a sealed envelope it has no key to open and stores it as ciphertext. When you open your inbox, the inquiry is decrypted in your browser, the only place your key exists, and becomes a lead. We move the data; we never read it.
Do I have to replace my website or my contact form?
No. You keep the form you already have. There are two changes: point the form’s action at your private Brun intake URL, and add one script tag to the page. The fields, layout, and design stay the same. No backend work, no rebuild.
Will my visitors know they’re using Brun?
No. There’s no Brun branding on your form or your page. Your visitors just fill out your contact form as usual. Your page never exposes an API key or an account ID: only a public intake handle that can’t read or decrypt anything on its own.
Is this really end-to-end encrypted, or just “encrypted at rest”?
Yes — real end-to-end encryption. Encryption happens in the browser before the data ever leaves the device. The ciphertext block above is what’s actually in our database: no name, no message, no contact info. “Encrypted at rest” usually means the vendor still holds the key and can read everything; we don’t.
What if I lose my recovery key AND my password?
We can’t reset it, restore it from backup, or recover any part of it, because we never had the key to begin with. That’s the tradeoff behind the privacy guarantee, so save your recovery key the moment you sign up.
Why no AI, integrations, or mobile app?
Each one is another door your data can leave through. An AI summary needs to read your data. An email integration ships your contacts to a third party. A mobile app expands the attack surface. Every feature we add weakens the “we can’t read it” promise, so we don’t add them.
Plans & pricing
Every plan gets the same zero-knowledge intake and the same board — the only difference is team size. No sales call, cancel anytime. Two changes connect your form; you can be reading sealed inquiries this afternoon.
Solo
$120/mo
1 user
For the solo practitioner who can't afford a leaked inquiry.
- Zero-knowledge secure intake
- Encrypted lead pipeline & inbox
- One-time $399 onboarding
Firm
$100/user/mo
Per user · 3-user minimum
For small firms sharing a secure pipeline across the team.
- Everything in Solo
- Team roles (owner, admin, staff)
- Add or remove seats anytime
- One-time $399 onboarding
Compliance
$150/user/mo
Per user · 10-user minimum
For firms that have to prove their controls, not just have them.
- Everything in Firm
- Audit-log export & SSO
- Encryption that shrinks breach exposure
- Priority onboarding & support
Every new subscription adds a one-time $399 onboarding fee to the first invoice — it covers guided setup, including connecting your existing form, and you never pay it again. 30-day money-back guarantee: not satisfied within 30 days of your first payment? We refund the first invoice in full, onboarding fee included. Prices in USD; billing managed self-serve in the Stripe portal; cancel anytime.