Encryption and access
How connections and storage are encrypted, how sign-in works, who gets which role and what goes into the audit log.
In transit
Traffic between your device and BeeSensible's production environments runs over TLS. So does traffic between our API and the detection environment. Our own components communicate inside an isolated cluster that cannot be reached from the internet; the database only accepts connections over TLS. One internal connection, between the API and the service that anonymises documents, has no additional encryption; it runs inside that isolated cluster.
At rest
The database is a managed PostgreSQL instance at Scaleway in the Amsterdam region, encrypted at rest at block-volume level (AES-XTS-512). Scaleway manages the keys as processor; BeeSensible has no access to the key material. This was verified through Scaleway's API on 21 August 2026. Database backups are kept for seven days.
Signing in
Users sign in through BeeSensible's own login environment (Keycloak). It is self-hosted at Scaleway and is not a third party. There, users choose Google, Microsoft or Microsoft Entra ID, a sign-in link by email, or the organisation's own identity provider. An organisation's own identity provider is linked once the email domain has been verified, and is then recognised automatically from the user's email address. Users can also sign in with a username and password; only a hash of that password is stored. The API checks every call against the signed-in user, the organisation in the token and the role.
Roles and administration
Admin functions are available to members with an admin role. Give that role only to people who need to configure BeeSensible or view the figures. Admin actions that decide who can sign in, such as verifying a domain or linking or unlinking an identity provider, go into an audit log that cannot be edited. Changes to the masking policy and switching the sandbox or evaluation mode on or off are recorded there too.
Within BeeSensible, only people who need it for their work have access to production systems, through role-based access control. Our hosting partners Scaleway and Hetzner hold ISO 27001 certification; BeeSensible itself does not.
Hosting
The API, the database, the storage and the login environment run on Scaleway in the Amsterdam region. The models run at Hetzner in Germany. Both are European companies: Scaleway is 96% owned by the French Iliad group; Hetzner Online GmbH is German. Both are ISO/IEC 27001:2022 certified; Scaleway also holds HDS certification for hosting health data, and CSA STAR Level 1.
For a full security overview or a vendor package, email trust@beesensible.eu.
