Security
Know where your data goes.
Every workspace is private, every role is checked on the server, and the AI model never sees raw rows. This page lists what is implemented today, as it works.
No certification such as SOC 2 or ISO 27001 is claimed. Owners and admins can export their workspace's security evidence from the app.
Your sources
Your BI Bee workspace
Controls
Twelve controls, all live today.
- 01
Private workspace
Every source, dataset, dashboard, report and audit query needs the signed-in workspace. One customer's data never appears in another's.
- 02
Encrypted source logins
Passwords, API keys and OAuth tokens for your sources are encrypted with AES-256-GCM on the server and never returned to the browser.
- 03
Four roles, checked on the server
Owner, admin, analyst and viewer. Every API route checks the role, so a hidden button is never the only thing standing in the way.
- 04
Personal columns marked for you
Email, phone, name and address columns are marked personal on import. Viewers see neither their values nor their names, on dashboards, in reports or in exports.
- 05
AI on your terms
The external AI model is on by default for new workspaces, and owners and admins can switch it off. It receives field names and types, summary figures such as totals, ranges and counts, up to eight common values of open category fields, and the question; never raw rows or values of fields marked personal or confidential. Any figure in an analyst answer must match your data.
- 06
Revocable AI tool tokens
Claude, Cursor and other MCP clients connect with read-only personal tokens. Owners and admins see every token in the workspace and can revoke any of them.
- 07
Activity log
Sign-ins and failed attempts, sources, syncs, dashboard edits, reports, team and billing changes and every AI tool call are logged. Owners and admins can export the evidence.
- 08
Rate limits
Sign-in, sign-up, password reset, booking and API requests are rate limited to slow down password guessing and abuse.
- 09
Hashed passwords and sessions
Passwords are hashed with scrypt and only hashes of session tokens are stored. You can see your active sessions and sign out other devices.
- 10
Old data deleted on schedule
Each sync keeps earlier snapshots for 7 days so you can roll back, then deletes them. Deleting the workspace deletes all of its data.
- 11
Safe spreadsheet exports
CSV exports neutralise spreadsheet formulas, so a cell cannot run a formula when the file is opened in Excel or Sheets.
- 12
Hardened web layer
Strict security headers (CSP, HSTS, no framing), same-origin checks on every change and signed webhooks from connected stores.
In practice
Who sees what. And a record of who did what.
Pick a role to see what it opens, then see the kind of entries the activity log keeps.
- Dashboards◐View, filter, export
- Data sources—No access
- AI analyst—Not available
- Personal columns—Hidden, names too
- Team and roles—No access
- Billing—No access
auth.login✓Signed inconnector.create✓Postgres · logins encrypteddataset.governance.update✓customer_email → personalauth.login.failed✕Wrong passwordmcp.tool_call✓query_dataset · totals onlydashboard.undo✓Restored the previous versionData lifecycle
From sign‑up to deletion.
Step 1
Sign up or join
An owner creates the workspace. Everyone else joins by invitation, with a role.
Step 2
Connect
Source logins are encrypted, and each sync is recorded with its row count.
Step 3
Classify
Columns are typed and personal ones marked. Mark any other column confidential.
Step 4
Work
Dashboards, reports, exports, the analyst and AI tools follow each person's role.
Step 5
Remove or delete
Removed members lose access on their next request. Deleting the workspace deletes its data.
Bring your security questions.
We will walk your IT and data team through these controls on a call, or answer by email.