Security is a first-class product decision.

Beaqon sits inside a compliance function that answers to regulators, auditors, and the customers whose money we help protect. That posture shapes how we build, host, and operate the platform.

This page summarises our security approach. If you would like our full security package, including penetration test summaries, sub-processor list, and DPA, reach out and we will share it under NDA.

Our approach

Security is built in from the beginning, not layered on top. Every design decision is reviewed against the same question: can we explain this to a regulator? If the answer is no, the design changes.

Infrastructure

• Hosted on tier-1 cloud providers (AWS / GCP) in the region of the customer's choice.
• Isolated network perimeter with a default-deny posture.
• Fully automated build and deployment pipelines; no manual production access for routine changes.
• Immutable infrastructure with continuous vulnerability scanning of images and dependencies.

Encryption

• In transit: TLS 1.2 or higher on every network hop.
• At rest: AES-256 for all customer data and backups.
• Cryptographic keys are managed in a dedicated KMS with rotation and audit logging.

Access control

• Role-based access, granted on the principle of least privilege.
• Multi-factor authentication is required for all Inteqore personnel and available for all customer users.
• Customer tenants support SSO via SAML or OIDC.
• All privileged access is time-boxed, justified, and logged.

Data isolation

Beaqon is multi-tenant with strict logical isolation between tenants. Every data-plane query is scoped to the requesting tenant; there is no path in the codebase that returns cross-tenant data.

Deployment options

Customers choose between our fully-managed SaaS or a self-hosted deployment inside their own infrastructure. Data residency and sovereignty are configurable per tenant.

Audit logging

Every meaningful action on Beaqon — logins, permission changes, case decisions, policy edits, filings — is captured in an immutable audit trail. Audit records are retained for the period agreed in each customer's contract, at a minimum meeting local regulatory requirements.

Backups and continuity

• Encrypted backups taken on a continuous basis and restored regularly.
• Recovery point and recovery time objectives are committed in the MSA.
• Regular disaster-recovery exercises across primary and secondary regions.

Incident response

We maintain a documented incident-response plan with defined roles, escalation paths, and customer-notification commitments. In the event of a security incident affecting customer data, we notify affected customers without undue delay, in line with our contractual and regulatory obligations.

Third-party security

Every sub-processor is reviewed before onboarding and re-assessed periodically. A current list is available on request.

Assurance and certifications

• ISO 27001-aligned information security management.
• Annual third-party penetration testing on the platform and infrastructure.

Formal certifications are on our roadmap and we will publish them here as they are achieved.

Responsible disclosure

If you believe you have found a security vulnerability affecting Beaqon, please email hello@beaqon.io with the subject line “Security”. We will acknowledge within one business day and work with you in good faith to investigate and remediate. Please do not publicly disclose before we have had a reasonable chance to respond.

Contact

Security questions or documentation requests: hello@beaqon.io.