OpenBracket is where Bracketmore releases software for organisations to run, nonprofit and for-profit alike. Not samples or showcases: working products, published under permissive licences with the commit history intact, free to use, fork and extend.

The first is OpenFML, financial planning software with its own financial modelling language. You state the inputs, the series and the assertions; the compiler resolves the dependency order, checks the units and refuses to run on a cycle. Models are plain text, so they stay yours and stay readable.

OpenFML Studio runs entirely in the browser: a live-recalculating budget with a model map, tracing, goal seek and Monte Carlo. No account, no install.

Who is responsible

Bracketmore is the controller for personal data processed through this website and through our own contact channels. Questions, access requests and complaints go to contact@bracketmore.com. We reply from a named address.

This website

The site is a single static page. It sets no cookies, runs no analytics and carries no tracking pixels, advertising tags or third-party scripts.

• Fonts. The typefaces are served by Google Fonts. Your browser requests them directly, which passes your IP address and the request headers to Google under Google’s privacy policy. Nothing else on the page leaves your browser.
• Hosting logs. The server that delivers the page keeps ordinary access logs (IP address, time, page requested, user agent) for security and capacity purposes. They are retained for no longer than 30 days.
• Theme choice. The light or dark setting is kept in memory for the current visit only. It is not stored.

When you write to us

If you email us we hold your name, address and the content of the exchange for as long as the conversation, and any engagement that follows, is live. We do not add you to a mailing list; there is none. We do not sell, rent or share contact data.

Our products

• Deal Accelerator is installed inside the acquirer’s own environment. Documents, indexes and review output stay there. No data is transmitted to Bracketmore, including telemetry.
• MedIAudit processes patient and claims data on behalf of Brazilian health operators, on infrastructure located in Brazil, under ANS and CFM rules and the Lei Geral de Proteção de Dados (LGPD). The operator is the controller; Bracketmore acts as operator (processor) under a written agreement.
• BeyondNoCode builds and runs systems for clients. Where those systems hold personal data, the client is the controller and the terms are set in the data processing agreement.

Your rights

Depending on where you are, you can ask what we hold about you, have it corrected or deleted, restrict or object to its use, or receive a copy in a portable form. Write to contact@bracketmore.com. We answer within 30 days, and sooner where the law requires it. You can also complain to the data protection authority in your country.

Transfers and retention

We keep personal data only as long as the purpose it was collected for requires, then delete it. Where data crosses a border we rely on the recipient country’s adequacy status or on standard contractual clauses, and we say which in the data processing agreement.

Changes

If this notice changes in a way that matters, the revision date below changes with it, and clients under contract are told directly.

Last revised September 2026

Roles

When we build, host or operate a system that holds personal data for you, you are the controller and Bracketmore is the processor. We act only on your documented instructions. If an instruction would, in our view, break the law that applies to you, we say so before acting on it.

What we commit to

• Purpose limitation. Personal data is processed only for the purposes set out in the engagement, and for nothing of our own.
• Confidentiality. Every person with access is bound by a written confidentiality obligation and has access only to what the work requires.
• Security. The measures described on the security page apply as a minimum. Higher standards agreed for a specific engagement take precedence.
• Sub-processors. We use infrastructure providers (cloud hosting, managed databases, email delivery) and name them in the agreement. We tell you before adding or replacing one and you can object. Each sub-processor is bound by terms no weaker than these.
• Data subject requests. If a request reaches us that belongs to you, we forward it within two working days and help you answer it.
• Incidents. We notify you of a personal data breach affecting your data without undue delay, and in any case within 48 hours of becoming aware, with what we know and what we are doing.
• Audit. You may audit our compliance, on reasonable notice, yourself or through an auditor bound by confidentiality. We provide the evidence needed for your own regulatory obligations.
• Return and deletion. At the end of the engagement we return the data in a usable format or delete it, at your choice, and confirm deletion in writing, keeping only what the law obliges us to keep.

Location

Data is processed in the location agreed for the engagement. For MedIAudit that is Brazil, without exception. For Deal Accelerator the data never leaves the acquirer’s environment and no processing agreement with Bracketmore is needed for it. Transfers outside the agreed location happen only on your instruction and under a lawful transfer mechanism.

Applicable law

These terms are written to satisfy the LGPD (Brazil) and the GDPR (European Union and United Kingdom). Where you are subject to another regime, the agreement is adapted to it.

The signed version

A full data processing agreement, with the sub-processor list and the technical measures annex, is issued with every engagement that involves personal data. To request a copy in advance, write to contact@bracketmore.com.

Last revised September 2026

Principles

• Data stays where you put it. Deal Accelerator installs into your tenancy, your datacentre or an air-gapped network with no outbound route. MedIAudit keeps patient data in Brazil. We design so that the question “where is the data” has a one-line answer.
• Review before ship. Every release passes a review by someone other than its author, covering code, dependencies and configuration, before it reaches a client environment.
• Least access. Production access is granted per person, per system, for the time it is needed, and it is logged.
• Encryption. Data in transit is protected with TLS 1.2 or later. Data at rest is encrypted with keys held in the client’s environment wherever the deployment model allows it.
• Dependencies. Third-party components are pinned, scanned for known vulnerabilities on every build and updated on a schedule, or immediately for an exploitable issue.
• Offline install. For air-gapped deployments we ship a signed bundle with a manifest of every component and its hash, so the install can be verified before it runs.

Operations

• Logging. Access and administrative actions are logged to a store the client controls, with retention set by the client.
• Backups. Where we operate a system, backups are encrypted, tested by restore, and kept in the same jurisdiction as the live data.
• Incident response. We maintain a written incident procedure. Affected clients are told without undue delay, and within 48 hours at most, with a post-incident report to follow.
• People. Everyone with production access has a background check appropriate to the work and signed confidentiality terms.

The security review

Before a first deployment we walk your security team through the architecture, the access model, logging, and how updates reach the environment. Detailed documentation is available under NDA. Write to contact@bracketmore.com with the environment and the constraint and we will send the deployment document and a time.

Reporting a vulnerability

If you find a security issue in anything we publish or run, tell us at contact@bracketmore.com with enough detail to reproduce it. We acknowledge within two working days, keep you informed while we fix it, and credit you if you want to be credited. We do not take legal action against good-faith research that stays within the systems you are authorised to test and does not access other people’s data.

Last revised September 2026

This website

The site is provided by Bracketmore for information. You may read it, link to it and quote from it with attribution. You may not scrape it into a commercial dataset, present its content as your own, or use it to impersonate Bracketmore or any of its units.

Accuracy

We keep the site accurate and we correct it when we find an error, but it is not advice and it is not a contract. Product capabilities, locations and figures are described as at the revision date below and may change. Nothing here forms part of an offer unless it is repeated in a signed agreement.

Products and services

Deal Accelerator, MedIAudit and BeyondNoCode engagements are governed by the agreement signed for each one, including its statement of work, service levels and data processing terms. Where those documents and this page differ, the signed agreement prevails.

Open source

Software published under OpenBracket is licensed under the terms stated in each repository (Apache-2.0 or MIT). Those licences, not this page, govern your use of that code. It is provided as is, without warranty, as the licences say.

Trade marks

Bracketmore, the bracket mark, Deal Accelerator, MedIAudit, BeyondNoCode and OpenBracket are names and marks of Bracketmore. Other names on the site belong to their owners and appear only to describe the work done for them.

Liability

To the extent the law allows, Bracketmore is not liable for loss arising from reliance on this website. Nothing on this page limits liability that cannot be limited by law, including for fraud or for death or personal injury caused by negligence.

Law

These terms are governed by the law of the country in which Bracketmore is registered, and disputes about them go to the courts of that country. Signed agreements state their own governing law.

Contact

Questions about these terms go to contact@bracketmore.com.

Last revised September 2026