Data room security, encrypted by default.

EU data residency

Documents stored in Cloudflare R2 EU jurisdiction. Application and Postgres on a Hetzner server in Helsinki, Finland. AI on our own hardware in the UK. Operating under UK GDPR, ICO-registered (ZC167314). Data never leaves the UK or EEA.

Encryption at rest - envelope, app-managed

Every document is AES-256-CBC encrypted with a unique 2048-byte random password before it is written to storage. The password itself is encrypted with S/MIME (AES-256) using a 4096-bit RSA public certificate. The matching private key is held only by the Beamprobe application server and required to decrypt anything, so R2 holds only ciphertext of your original files. The page images we render for the viewer are stored in R2 under R2's own AES-256 encryption at rest (keys managed by Cloudflare) and served through short-lived signed links.

The text we extract for search, the AI summaries and page notes written from it, and your Q&A are encrypted in our database too (AES-256-GCM), with the key held on the application server rather than in the database or its backups, so a copy of the database on its own reveals none of it. Search runs on the server after decrypting, not in the database.

Honest limit: in a regular room this is encryption at rest with app-managed keys, not end-to-end encryption - our servers can decrypt your documents in order to render and search them. When that is not enough, a Pro or Business room can be end-to-end encrypted instead: each PDF is encrypted in your browser and Beamprobe never holds the key, so we cannot open it. Most data rooms decrypt documents on their own servers to show them, even when the customer manages the keys.

AI on our own hardware

Document summaries, Ask this room, the deck audit, page names and request list suggestions run on a language model hosted on hardware Beamprobe operates itself in the UK. When a page has no text, its summary and page name may be read from an image of the page, on the same hardware. Your documents are never sent to OpenAI, Google, Anthropic or any other cloud AI provider. Requests are kept briefly in operational logs and never used to train or fine-tune a model.

Encryption in transit

All traffic over TLS (1.3 where the browser supports it, 1.2 at least), with HSTS and a Content Security Policy. Storage signed URLs are short-lived. The database is backed up nightly to a separate server over SSH.

Access controls

Every link has its own unguessable token and its own choice of documents. Links can be revoked, expired, limited to a number of views or password-protected, with view limits and expiry enforced on the server. A link can ask for the visitor's email, require a named recipient to prove they control their mailbox through a one-time emailed link, or require NDA acceptance, which records name, email, IP and time before access. Downloads are off unless you turn them on for a link. On paid plans, pages carry a watermark on screen and in downloads.

Authentication

Passwords hashed with bcrypt (cost 12). Two-factor sign-in with an authenticator app on every plan, with the option to trust a device for 30 days. Sign in with Google or with a Microsoft work or school account. Email verification required before an account is active. Password reset links expire after 1 hour.

GDPR compliance

On request we erase an account with its rooms, documents, page images and analytics. NDA acceptance records are kept for 6 years after their room or link is deleted, and deleted with the account. We never sell your data.

Bot filtering

Email security scanners follow links to scan for malware - inflating analytics. Beamprobe detects bots by user-agent and excludes them from view data automatically.

Records and exports

Every room exports its activity as a CSV: who opened which link and when, with IP address, pages read, downloads, NDA acceptances, recipient verifications, Q&A, signatures and owner changes. The closing ZIP adds the NDA log, Q&A and request list, with a SHA-256 manifest and a certificate to check every file against. Deleting a room removes its documents, page images and encryption keys from storage and leaves a deletion certificate in your account settings.

Redaction

Redaction burns black boxes into the page image itself: each marked page is redrawn without its original text, fonts or annotations, then given a fresh searchable text layer read from what is left, so nothing under the boxes can be copied, searched or extracted. Find names and terms, email addresses, phone numbers, National Insurance numbers, bank details, card numbers and postcodes, scanned pages included, or draw boxes by hand. Applying replaces the document and deletes the original file, its page images, its extracted text and its search entries; the file's title and author are dropped too.

Monitoring and incident response

Application errors, password guessing, a link reading or downloading far more than a person does, and failing uploads alert the founder directly. The service, database, backups and certificates are checked every five minutes. A written incident response plan covers containment, telling affected customers, and keeping a record of every incident.