Security & privacy
Today's controls and today's gaps. The exact mechanisms are in the security whitepaper.
Tenant isolation
Every tenant table carries an organization id and a forced PostgreSQL row-level security policy the application role cannot bypass.
Each request sets its organization id and restricted role in its own transaction. Nothing carries over on a pooled connection.
An unset organization id returns zero rows. Tests assert it for every tenant table.
Private storage under random keys. A download resolves the file's record under row-level security, then gets a link that expires within ten minutes.
Owner, admin, agent, requester, checked on the server for every request with row-level security as the backstop. Requesters see only their own tickets, public articles, and devices.
Beacon staff sign in separately. Support impersonation runs as an ordinary tenant session and writes an audit entry your administrators can see.
Authentication
Hashed with argon2id at the OWASP-recommended parameters. Never logged. Minimum eight characters.
Fifteen-minute access tokens. 30-day refresh tokens, hashed, rotated on every use, revoked on sign-out, password change, or account disable, and rejected if reused after a five-minute grace window.
OpenID Connect with PKCE for Google Workspace, Microsoft Entra ID, Clever, ClassLink, and any OIDC provider. Client secrets are AES-256-GCM encrypted at rest and never returned by the API. Sign-in can be limited to your email domains.
600 requests per minute per signed-in person, with ceilings per organization and per network address. Sign-in 120 per minute per address, single sign-on start 300, token refresh 600, password change 20 per minute per person, five sign-ups per 15 minutes per address. An email address locks after 10 failed passwords in 15 minutes, a network address after 300 failed sign-ins in 15 minutes.
A honeypot field and a daily limit on new organizations per address. No captcha, since school content filters block their scripts.
Prefixed, shown once, hashed, scoped read or write, revocable, last use tracked. Webhooks are signed with HMAC-SHA256 and a timestamp.
Data protection
TLS 1.2 or higher, HTTPS forced, HSTS for two years including subdomains. Private database network, TLS for outbound email, encrypted storage and backups. Application secrets live in a managed secret store, never in source code, images, or CI logs.
X-Frame-Options DENY, nosniff, Referrer-Policy, and Permissions-Policy on the API and the web app. The web app's Content-Security-Policy forbids framing.
Images, PDF, text and CSV, Office documents, logs, and zip only, 25 MB maximum, type checked against the file's bytes. SVG, HTML, and executables are rejected. Downloads carry nosniff and a sandboxing policy.
SSO, role, API key, webhook, automation, and settings changes, user creation and disabling, bulk updates, exports, deletions, and any support impersonation. Per organization, in Admin → Audit for the life of your organization.
Request id, user, organization, route, status, and latency, never request bodies. Authorization headers, cookies, passwords, tokens, and secrets are redacted, including in logged URLs. Retained about seven days, never longer than 30.
A public status page shows 90 days of measured availability for the website, the app, and the API. The terms state a 99.9% monthly availability target measured at the API.
Daily backups, 14-day retention, rehearsed restores. Every deploy is an immutable image that can be rolled back, and schema changes keep the previous version working.
Administrators export everything as JSON and CSV at any time. An owner can delete the organization from Settings: everything is erased, sessions and keys are revoked, and backups roll off within 30 days. Deletion certificate on request.
AI
The ticket or question text, plus your category names, team names, and article titles. Never attachments, passwords, or your directory.
Anthropic, under commercial API terms that do not permit training on customer data. Inputs may be retained up to 30 days for trust and safety, then deleted.
A technician accepts, edits, or ignores every suggestion. AI never closes a ticket or sends a reply. Administrators can turn off triage, suggested replies, and portal deflection individually.
Suggestions and token counts, stored with the ticket. No separate copy of the prompt.
Every ticket and public reply is screened, with AI on or off, for signs of self-harm, harm to others, abuse, or a medical emergency. A flagged ticket becomes urgent and tagged, every administrator is notified in-app and by email without the message text, and the writer sees crisis resources including the 988 Suicide & Crisis Lifeline. Automations and AI cannot lower its priority. A person can, after review.
If the model is unavailable or an allowance is used up, everything works manually. No ticket waits on AI. Beacon is not a crisis service. In an emergency, call your local emergency number.
Student data
Beacon acts as a school official with a legitimate educational interest under the school's direct control, uses education records only for the purposes the school authorizes, and does not re-disclose them except as the school directs or the law requires.
Beacon does not knowingly collect information from children under 13 except through a school that has authorized it for educational purposes. Nothing is collected for marketing. No third-party trackers in the portal or the app.
No sale of student information, no targeted advertising, no profiles for non-educational purposes, deletion on request. Beacon signs the Student Data Privacy Consortium NDPA and state addenda on request.
On request for any customer. For the EEA, UK, or Switzerland, a data processing addendum with standard contractual clauses.
A school can delete any record at any time. All of its data is permanently deleted within 30 days of its request or the end of its agreement, confirmed in writing on request.
Beacon notifies affected customers of a breach of personal information without undue delay and within 72 hours of confirming it, with what they need for their own notifications.
Full terms in the Privacy Policy, section 8.
Subprocessors
Each is bound by contract to use data only to provide its service to Beacon. District and Enterprise customers get 30 days' notice before any addition.
| Provider | Purpose | Location | What it can see |
|---|---|---|---|
| Fly.io | Hosting for the API and the database | United States (Virginia) | All service data at rest and in transit, encrypted |
| Vercel | Hosting for the web app and this website | United States | Request logs; the web app stores no customer data on Vercel |
| Anthropic | AI features | United States | Ticket text and organization category and article names when an AI feature runs |
| Resend (on Amazon SES) | Sending and receiving email | United States | Addresses, subjects, and message text of email sent and received |
| Cloudflare | Domain registration and DNS | United States | DNS queries only |
| Apple, Google, Expo | Mobile app distribution and push notifications | United States | Push tokens and notification text |
Not yet
Security questionnaires ask about these. Straight answers.
No SOC 2 report yet. A Type I audit, then a Type II, is on the roadmap. The controls on this page are in place today and detailed in the whitepaper.
No third-party penetration test report yet. One is planned as part of audit readiness. Dependencies are audited before each release, with no automated scanning of dependencies or container images yet.
None built in for password sign-in. Use single sign-on, and your identity provider's multi-factor policy applies to Beacon.
United States only. Enterprise customers who need data on their own infrastructure can run the on-premises edition.
Report an issue
Email security@beaconhelpdesk.com. We acknowledge within two business days, triage within five, and aim to fix critical issues within seven days.
Good-faith research inside your own organization, without accessing others' data or disrupting the service, is welcome and will not be pursued legally.
Try it
Sixty seconds of video, then a free organization you can inspect yourself. No sales call.