Security Overview

This Security Overview describes the risk-based safeguards 7BE is designed to maintain for its Services. It supports, but does not replace, the 7BE Data Processing Addendum, Project Order, or a customer-specific security exhibit.

Security is a shared responsibility. The exact controls applicable to a Project depend on the product, data, environment, approved providers, and written Project requirements.

1. Security Governance

7BE assigns responsibility for security and privacy, maintains policies and response procedures proportionate to its size and risk, and reviews material changes, incidents, vendors, and vulnerabilities.

Personnel and contractors with access to confidential systems or data are subject to confidentiality obligations and receive role-appropriate guidance. Security responsibilities are incorporated into relevant development, operations, support, and Project workflows.

2. Access Control

7BE is designed to use unique accounts, role-based access, least privilege, timely access approval and revocation, and multi-factor authentication for privileged or high-risk access where supported.

Production and Customer Data access is limited to personnel and approved providers with a documented need. Shared credentials are avoided; emergency access is restricted and reviewed.

3. Data Protection

Data is encrypted in transit using current secure protocols. Data at rest is encrypted where supported by the relevant hosting, database, storage, and backup systems.

Customer Data is minimized, logically separated, retained for documented periods, and deleted or returned under applicable agreements. Secrets and credentials should be stored in approved secret-management systems rather than source code, tickets, public messages, or ordinary documents.

7BE does not use Customer Data to train or improve a general-purpose or shared model. Production data is provided to a Project-specific AI or testing provider only after disclosure, authorization, and appropriate contractual controls.

4. Product and Change Security

Material application and infrastructure changes are designed to receive version control, review, testing, and controlled deployment. Dependencies and vulnerabilities are assessed and prioritized according to exploitability, exposure, and impact.

7BE uses reasonable separation between development, testing, and production activities. Test data should be synthetic or de-identified unless production data is necessary and expressly approved.

5. Logging and Monitoring

7BE is designed to log authentication, privileged activity, material changes, errors, and security-relevant events appropriate to the Service. Logs are access-restricted and retained for a period proportionate to security and legal needs.

Monitoring and alerting are risk-based. Not every event is reviewed in real time, and logs do not guarantee detection of every incident.

6. Vulnerability Management

7BE maintains a channel for reporting suspected vulnerabilities, evaluates credible reports, prioritizes remediation based on risk, and may use automated and manual assessment tools.

Users must not test 7BE or third-party systems without authorization. Security issues should be reported to security@7be.io with sufficient detail to reproduce safely.

7. Incident Response

7BE maintains an incident process designed to identify, contain, investigate, remediate, preserve evidence, communicate, and learn from security events. Customer notification for Customer Personal Data is governed by the DPA, which targets notice without undue delay and, where feasible, within 48 hours after confirmation.

Users must promptly report suspected compromise and cooperate with containment, credential rotation, evidence preservation, and legally required notices.

8. Availability, Backup, and Recovery

7BE relies on vetted infrastructure providers and uses backup and recovery measures proportionate to the Service. Backups are protected and restoration procedures are reviewed or tested according to risk.

Unless a written service-level agreement states otherwise, 7BE does not promise uninterrupted availability, a specific recovery time, or a specific recovery point. Project-critical continuity requirements must be stated in the Project Order.

9. Vendor and Subprocessor Risk

7BE evaluates providers based on function, data, access, location, contractual protection, and available security evidence. Providers processing Customer Personal Data are subject to the DPA and Subprocessor List.

Project-specific AI providers must be identified before receiving Customer Data. A provider’s own certification does not by itself certify 7BE or a customer’s complete system.

10. Data Retention and Disposal

Retention is tied to purpose, contract, security, dispute, tax, and law. Raw Verification Data and temporary production extracts are normally deleted or returned within 30 days after final Project resolution, with residual encrypted backups expiring within 90 additional days.

Legal holds and security investigations may require restricted retention. Disposal methods are appropriate to the medium and provider capability.

11. Physical Security

7BE primarily relies on the physical and environmental controls of its hosting, data-center, office, and managed-service providers. Access to 7BE workspaces and devices is restricted according to role and risk.

12. Customer Responsibilities

Customers and Agencies must:

• protect accounts and enable available multi-factor authentication;
• grant minimum access and promptly revoke departed users;
• provide only necessary, lawfully obtained data;
• avoid secrets or sensitive information in public fields;
• approve Project providers, environments, retention, and residency;
• maintain secure endpoints, integrations, and destination systems; and
• report suspected incidents promptly.

13. Assurance and Claims

7BE will not claim a security certification, audit opinion, regulatory authorization, or compliance status unless it is current, applicable, and expressly identified in writing. This Overview is not a certification, penetration-test report, SOC report, warranty, or guarantee that an incident cannot occur.

Customers may request available security information at security@7be.io. Additional assessments or customer-specific controls may require a separate agreement.