Report a vulnerability
Send findings to security@beztly.com. We acknowledge within one business day and will keep you updated until resolution. We do not pursue good-faith researchers.
Security and trust
How Beztly handles access, data and failure. If something here is not specific enough for your review, ask us and we will answer in writing.
Data handling
| Where inference runs | Inside your own cloud accounts and VPCs. Prompts, completions and model weights do not transit Beztly infrastructure. |
|---|---|
| What the control plane holds | Configuration, policy, metadata and aggregated metrics. Payload content is not collected. |
| Encryption | TLS 1.3 in transit. Encryption at rest using keys you control, with customer-managed key support on supported providers. |
| Access control | Single sign-on via OIDC or SAML, SCIM provisioning, role-based access down to the endpoint, and short-lived service credentials. |
| Audit | Access, configuration change, rollout and revocation events recorded with actor, time and origin, exportable on a schedule. |
| Retention | Configurable per data class, with field-level redaction available for records that reference sensitive financial or clinical data. |
Operating practice
DISCLOSURE
INCIDENTS
If something goes wrong
Affected customers are contacted directly with what we know, what we do not, and what we are doing — before the write-up, not after it.
REVIEWS
Questionnaires and audits
Send your control questionnaire before the evaluation. Current reports and subprocessor lists are available under NDA.
Questions your security team needs answered?
We would rather have that conversation early.