Security

Last updated: September 26, 2026

BEVEL is built multi-tenant from the ground up: host-based resolution, declarative tenant config, and realtime namespaces that keep channel history with the organization.

Authentication

People sign in with Google, Sign in with Apple, Microsoft Entra ID, an SMS one-time code, or an email magic link. There is no password database. OTP codes are hashed, expire in ten minutes, and are limited to five attempts with per-destination and per-IP rate limits. We talk to Apple over the raw Apple ID REST APIs (we mint the ES256 client secret). SMS uses Twilio Programmable Messaging. Email uses SendGrid. Access to a workspace is additionally gated by allowed email domains and exact email allowlists. Platform entry routes people to Private plus every membership after sign-in.

Isolation

Each workspace is a tenant with its own domain, brand, features, and realtime namespace. Sessions mint tokens for the active org — not a shared chat bag. Agents and channels bind to that namespace. We treat attempts to cross tenant isolation as a security incident.

Transport and secrets

Live chat over WebSocket, streams over SSE, media only when you enable it. TLS is required on public hosts. Local development uses trusted local certificates and HTTPS .lvh.me domains. Production secrets live in AWS Secrets Manager; development secrets live in 1Password. Credentials are never committed to the repository.

Validation

Tenant configs are schema-validated. Doctor checks catch misconfiguration before release. Prefer declare → validate → ship over hand-edited production state.

Data protection

See the Privacy Policy, GDPR, CCPA, and DPA for processing roles, subprocessors, and rights. Workspace customers remain controllers of channel content.

Report an issue

Security reports: hello@bevel.is. Please include steps, impact, and whether tenant isolation is involved. We will acknowledge in a reasonable time and will not pursue good-faith research that stays within this policy.