Security overview

Beamly is built and run by an engineering team that has shipped regulated software in healthcare and disability services. We bring that operational rigour to the platform.

Hosting & isolation

• Customer data lives in our Sydney region.
• Each customer tenant is logically isolated at the database level using Postgres row-level security. Production data is never co-mingled across tenants.
• Production access is restricted to engineers on the operations roster, with hardware-key 2FA and full audit logging.

Encryption

• TLS 1.2+ in transit (TLS 1.3 preferred).
• Encryption at rest for databases, backups, and object storage.

Backups & recovery

• Daily encrypted backups with 30 days' retention.
• Point-in-time recovery to within five minutes for the prior 7 days.
• Quarterly disaster-recovery drills.

Identity & access

• Role-based permissions on every plan.
• SSO (SAML / OIDC) on Agency and Scale plans.
• Granular per-client access controls and audit log.

Application security

• All releases go through code review and automated CI checks.
• Dependency scanning on every build.
• Annual external penetration test; remediation tracked publicly to customers.

Responsible disclosure

Email [email protected] with anything you find. We acknowledge inside one business day and won't take legal action against good-faith research.