Encryption and access
How connections and storage are encrypted, how sign-in works, and who gets which role.
In transit
Traffic between your device and BeeSensible's production environments, and between our API and the detection environment, runs over TLS. Our own components talk to each other inside a shielded cluster that is not reachable from the internet; the connection to the database requires TLS and refuses otherwise. One internal leg, between the API and the service that anonymises PDFs, does not yet carry additional encryption. That is on our improvement list.
At rest
The database is a managed PostgreSQL instance at Scaleway in the Amsterdam region, with encryption at rest at block-volume level (AES-XTS-512). Key management sits with Scaleway as processor; BeeSensible has no access to the key material. This was verified through Scaleway's API on 21 August 2026. Database backups are kept for seven days.
Signing in
Users sign in through BeeSensible's own login environment (Keycloak), which runs self-hosted at Scaleway and is not an outside party. There a user chooses Google, Microsoft, or Microsoft Entra ID, a sign-in link by email, or the organisation's own identity provider, which is linked after verification of the email domain and recognised automatically from the email address. There is also a username and password route; if a password of its own is set there, only a hash of it is stored. The API checks every call against the signed-in user, the organisation in the token, and the role.
Roles and administration
Admin functionality is intended for members with an admin role. Assign that role only to people who need to configure BeeSensible or view the figures. Admin actions that decide who can sign in, such as verifying a domain or linking or unlinking an identity provider, go into an audit log that cannot be edited.
Within BeeSensible, only those who need it for their work get access to production systems, through role-based rights. Our hosting partners Scaleway and Hetzner hold ISO 27001 certification; BeeSensible itself does not.
Hosting
The API, the database, the storage, and the login environment run on Scaleway in the Amsterdam region. Detection runs on the user's own machine, through the desktop app, or on BeeSensible infrastructure in the EU, with the compute for the models at Hetzner in Germany. When detection runs on-device, the text being checked stays on the machine.
For a full security overview or vendor package, email trust@beesensible.eu.