Security

Alpha · last updated 7 November 2026

The controls protecting a Beamling deployment and how to report a problem.

Sign-in and sessions

Sign-in uses Google OIDC with state, nonce and PKCE. The transaction is encrypted and expires after ten minutes. Session tokens are random, stored only as SHA-256 hashes, and delivered in HttpOnly, Secure, SameSite=Lax cookies in production. A session expires after 30 days without use and 90 days after sign-in at the latest; signing in again replaces the previous session. You can revoke one session or all sessions from Settings.

Encryption

Provider credentials and conversation content are encrypted in the application with AES-256-GCM before they reach PostgreSQL. Each workspace has its own data key, wrapped by a managed KMS master key. A database dump or backup contains ciphertext, not plaintext content. Transport to the database and to public origins uses TLS.

Access and logging

Application access is scoped to the signed-in account. Internal operator endpoints require a separate secret of at least 32 bytes and expose no user content. Structured logs are intended to exclude keys, session tokens, request bodies, questions and answers. Sign-ins, key changes, data exports and account deletions are recorded as audit events with a keyed hash of the account and IP address.

Reporting a vulnerability

Report vulnerabilities privately through the contact page; the address is also published in security.txt. Include the affected URL, reproduction steps and impact. We acknowledge reports within two working days, keep you informed while we fix the issue, and credit you when the fix is published if you wish.

We will not pursue legal action for research done in good faith that follows these rules: use only your own account, keys and data; do not access, change or keep other users' data; do not degrade the service, send spam or run denial-of-service or social-engineering tests; and give us reasonable time to fix the issue before disclosing it.

Limits

Beamling is an alpha service. No service can promise perfect security. This page describes the current controls, not a warranty or an independent certification.