Security and Trust

Security is built into how Beam runs.

Organizations trust Beam with the record of their equipment, licenses, contracts and day-to-day operations. This page explains, at a high level, how we protect that information: how the platform is built, how data is secured, who can access it and how we respond when something goes wrong.

It is intended for customers, prospective customers and anyone researching Beam's security practices. If you need more detail for a security review, see Security Reviews and Documentation.

1. Our Approach to Security

In short: security is part of how Beam is designed, built and operated, and it is owned by named people rather than left to chance.

Beam is the system of record for the equipment, licenses, contracts and operations behind some of the most demanding live and media environments. We treat the information our customers keep in Beam accordingly: protecting its confidentiality, integrity and availability is a core requirement of the platform, not an add-on.

Our security program is defined in a written Information Security Policy and a technical Security Guide. The policy applies to every Beam employee, contractor and third party with access to Beam systems or data. The policy is reviewed regularly to keep it current, and accountability for maintaining it, reporting significant risks and seeing corrective actions through sits with Beam's engineering leadership.

We run regular internal risk assessments and audits. Findings are recorded, assigned an owner and a severity, and tracked through to closure, and risk assessments are reviewed at least annually and whenever significant changes are made to the platform.

2. Platform and Infrastructure

In short: Beam runs on Amazon Web Services inside a private network, behind Cloudflare, with the primary database managed by PlanetScale.

Beam is a cloud-based, multi-tenant SaaS platform. Its core components are:

• Edge. All traffic to the web application and the API passes through Cloudflare, which manages DNS and provides distributed denial-of-service (DDoS) protection.
• Application tier. Application and background job servers run on AWS compute inside a virtual private cloud (VPC), with a load balancer in front of the application servers.
• Data tier. The primary PostgreSQL database is managed by PlanetScale on AWS, with network access restricted to Beam's application servers. Supporting data stores run within the VPC.
• Files. Uploaded files and static content are stored in private Amazon S3 buckets that are not publicly accessible.

Beam also relies on the physical security, resilience and compliance programs of these infrastructure providers, each of which publishes its own security and compliance documentation.

3. Data Protection and Encryption

In short: customer data is encrypted in transit and at rest, and the most sensitive values, such as secrets and keys, are held in a dedicated vault.

• Encryption in transit. Connections to Beam use HTTPS with TLS 1.2 or higher. Engineers also use TLS 1.2 or higher to reach production infrastructure.
• Encryption at rest. Databases, storage volumes and file storage are encrypted at rest using AES-256 or equivalent industry-standard encryption.
• Secrets and keys. Secrets that customers store in Beam, such as credentials, keys and webhook secrets, are held in Microsoft Azure Key Vault. Their values are never written to Beam's application databases, logs or monitoring systems.
• Files. Every file request requires a signed URL, so stored files cannot be reached through a public link.

We classify information by sensitivity (restricted, confidential, internal and public) and apply the strictest controls to restricted information such as secrets, keys and credentials. Customer data is collected and retained only as needed to deliver the service, and is deleted on customer request, subject to backup retention.

4. Authentication and Access Control

In short: customers control who can sign in and what each person can see and do, down to individual records.

Signing in

Authentication is handled by Auth0 using a standard OAuth flow. Every request to the Beam API carries a token that is verified on the server, and refresh tokens are rotated. Beam supports:

• Multi-factor authentication (MFA), adding a second factor such as an authenticator app code to a password.
• Single sign-on (SSO) with identity providers including Microsoft Entra ID and Okta, so organizations can manage access centrally.
• Denial-of-service protection at the edge, through Cloudflare.

Permissions inside Beam

Beam uses role-based access control with three layers that work together:

• User Roles, from Admin to Viewer, define which actions a person can take: read, update, create, delete or configure.
• User Groups let Admins decide, module by module, whether a group has full role-based access, view-only access or no access at all.
• Access Attributes restrict individual records to specific groups, so sensitive equipment, contracts or locations are only visible to the teams that need them.

Each customer's data is isolated within its own tenant. Access rules are enforced when data is queried, so only records a user is entitled to are returned, and again by the application before any action is carried out. User activity is logged to support auditing and investigation.

API and webhooks

• API keys are created by privileged users, generated with a cryptographically secure random generator (256 bits of entropy) and shown only once. Beam stores only a hash of each key, never the key itself.
• API keys are subject to the same permission model as users, so a key can never reach data its owner could not.
• Webhooks are delivered over HTTPS and signed, so receivers can verify they came from Beam. Webhook payloads carry record identifiers rather than sensitive content, and any secrets in a webhook's configuration are stored in the encrypted vault.

5. How Our Team Handles Customer Data

In short: Beam staff work on a least-privilege, need-to-know basis, and production access is limited to a small group of engineers.

• Access to systems and data is granted by role, reviewed when roles change and revoked promptly when someone leaves, including accounts, keys and devices.
• Production access is limited to the engineers who need it to operate the platform. Other staff are granted access only when essential, and only to the resources they require.
• Staff use individual company accounts. MFA is required for infrastructure and vendor access wherever it is supported, and SSO is used where available. Server access requires key-based authentication and MFA.
• Staff may access customer data only for a specific, legitimate purpose, such as a support request, and that access is tied to a recorded ticket.
• Customer data stays within approved company systems. It is not copied to personal devices or accounts, shared through informal channels, or entered into unapproved tools, including third-party AI services.
• Real customer data is not used in development, testing or demonstrations unless it has been anonymized or explicitly approved.
• Devices used to access Beam systems must run a supported, up-to-date operating system, and customer data is handled only on trusted or secured networks.

Every employee acknowledges Beam's security policies during onboarding and receives training on secure development and the handling of customer data. Confidentiality obligations continue after employment ends.

6. Secure Development

In short: security is built into Beam's software development life cycle, from code review through to deployment.

• Every code change is made through a version-controlled pull request and reviewed by at least one engineer other than its author before it is merged.
• Code is checked with static application security testing (SAST) and dependency scanning, and findings are fixed within defined timeframes.
• Changes reach production through an automated, controlled deployment process that can be rolled back, rather than through manual changes.
• Secrets and credentials are never committed to source code, tickets or chat.
• New features that affect authentication, authorization or the handling of sensitive data receive a dedicated security review.

7. Vulnerability Management and Testing

In short: Beam scans continuously, fixes critical issues fast and has its platform tested by an independent third party every year.

• Code, infrastructure and endpoints are scanned for vulnerabilities on an ongoing basis, and every finding is logged and tracked.
• Critical vulnerabilities are targeted for remediation within 7 days, and actively exploited vulnerabilities are prioritized regardless of rating.
• Operating system and software security updates are applied on a regular schedule, and promptly for critical issues.
• An independent security firm performs penetration testing of the Beam application at least annually. The most recent test was completed in August 2026 and found no critical, high or medium severity issues.
• Any exception to these timeframes must be documented, formally risk-accepted and given a review date.

8. Monitoring and Incident Response

In short: Beam continuously monitors its platform and has a defined process for responding to, and telling customers about, security incidents.

Beam continuously monitors its application, infrastructure and databases for errors, downtime, performance issues and anomalies. Activity on production systems is monitored by an extended detection and response (XDR) and security information and event management (SIEM) platform, and alerts are reviewed by the engineering team.

Our incident response process covers detection, containment, eradication, recovery and post-incident review. Every incident is logged, assigned a severity and tracked. If an incident affects customer data, Beam notifies affected customers directly, explaining what happened, what data was involved and the steps taken to remediate it. Post-incident reviews identify root causes, and the resulting corrective actions are tracked to closure.

9. Business Continuity and Backups

In short: Beam keeps layered backups of critical data and can restore the service and redeploy the application if a disruption occurs.

• Backups are taken multiple times a day, daily and weekly, and kept for two days, one month and one year respectively.
• The primary database also supports point-in-time recovery within its backup window.
• In the event of a disaster, backups can be restored and the application redeployed through Beam's automated deployment process.

Beam also benefits from the business continuity and disaster recovery capabilities of its cloud infrastructure providers.

10. Third-Party Providers

In short: Beam assesses its vendors before using them, gives them only the data they need and works with established infrastructure providers.

Before onboarding, third-party vendors are assessed against Beam's security standards, including a review of their security documentation and compliance reports. Vendors receive access only to the data they need, vendors that handle sensitive data are bound by written agreements, and any vendor change that affects how data is handled is reviewed by engineering leadership.

The key providers that store or process data on Beam's behalf are:

• Amazon Web Services: hosting infrastructure and file storage
• PlanetScale: managed database
• Cloudflare: DNS, edge protection and DDoS mitigation
• Auth0: user authentication and identity data
• Microsoft Azure Key Vault: storage of customer secrets

11. Compliance and Certifications

In short: Beam designs its controls toward SOC 2 standards. It does not currently hold a formal SOC 2 certification.

Beam's policies and controls are aligned with the SOC 2 trust services criteria and with industry best practice. Beam also monitors the legal, regulatory and contractual obligations that apply to the data it handles, including customer security and data protection requirements, and updates its practices accordingly.

For details on how Beam collects and uses personal information, see our Privacy Policy.

12. Security Reviews and Documentation

In short: Beam regularly supports enterprise security reviews and can share supporting documentation with customers and prospects.

Beam works with the security and procurement teams of enterprise media, sports and technology organizations, and completes third-party security questionnaires and reviews as part of their procurement processes. Depending on your requirements, the following can be made available on request, and may require a non-disclosure agreement:

• Beam's Information Security Policy and Security Guide
• A platform architecture overview
• A summary of the most recent independent penetration test
• Completed security questionnaires

13. How Can You Contact Us About Security?

To request security documentation, ask a question about Beam's security practices or report a potential security issue, please contact us through our contact form (choose "Security or privacy"), or by post to:

Beam Dynamics, Inc.
Security and Trust
500 W 5th Street, Suite 400
Winston-Salem, NC 27101
United States

If you believe you have found a security vulnerability in Beam, please include enough detail for us to reproduce it, and give us a reasonable opportunity to investigate and fix it before sharing it with anyone else.