Security & Trust

Operating entity

Bayeto is operated by Pierre Neuman as an individual — no legal entity exists yet, so this names a person rather than a company. The service is in its design-partner pilot phase, and incorporation precedes any production contract.

Data path & minimization

Web uploads are parsed in your browser against a 12-field whitelist; the preview names every accepted and ignored column, and only normalized schema rows are transmitted (the server re-validates each field). API-pushed and live-streamed telemetry (the LiteLLM connector) is filtered server-side in memory with the same whitelist: prompt content is never read or stored, even when a proxy's callback payload carries it — and the documented LiteLLM configuration disables message logging at the source, so it never leaves your infrastructure. Non-schema content — prompts, user identifiers, emails, session ids — is never persisted anywhere. The schema contains no personal data by design.

Processing locations & subprocessors

Those 4 are the complete list: no analytics, no advertising trackers, no data broker.

No language-model provider receives your telemetry, or any figure derived from it: the engine is deterministic and nothing is sent to a model to produce a recommendation.

Tenant isolation

Every telemetry row is keyed to a per-workspace tenant id generated server-side; every read flows through one membership funnel that returns 404 for any workspace the signed-in user holds no membership in (not-found and not-a-member are indistinguishable). Workspace access is decided by a membership record and nothing else, so removing someone removes their access in the same place every read already looks. Upload writes refuse reserved/shared tenants structurally. Isolation is enforced at the data-access layer, not by route matching.

Encryption, backups, retention

TLS 1.2+ in transit everywhere; storage encrypted at rest by Neon (AES-256). Database backups and point-in-time recovery are provided by Neon. Retention: your telemetry lives until you delete it. Workspace deletion is a self-serve control (no ticket) that immediately and permanently removes your telemetry rows, declared context, API keys, share links, implementation marks, the audit trail and the workspace record. Some operational records are not yet covered by the self-serve purge — delivery journals, staged spans awaiting pricing, signed receipts, application-identity records, implementation-event logs, telemetry connection settings, benefit-stream records, upload attestations, pre-change baseline records, recommendation-delivery records, ingest-batch provenance, and derived caches; extending the purge to them is tracked work, and this sentence names them until it ships. Account deletion is performed manually on request — email us and it is completed within 30 days.

Access control & keys

Sign-in via Clerk with SSO live for Google, Microsoft, and GitHub (passwords never touch Bayeto). Telemetry API keys are hashed at rest, shown once at creation, scoped to one workspace, revocable, carry an optional expiry chosen at creation (enforced at authentication with the same uniform response as a revoked key), and display prefix + created + last-used + expiry times. Share links always expire and are revocable instantly. Every key, link, upload, and decision operation writes an append-only audit event, visible in the workspace's Settings and deleted with the workspace. Production infrastructure access is limited to the operator.

Test evidence & certification posture

Every isolation claim on this page is an executable test, not prose: the ownership funnel, the share-link capability model, the no-affordance guarantee on shared views, the browser-side upload filter, and the cross-surface ledger version are each pinned in CI — a regression is a failed build. The inventory is below rather than available on request: every claim names the file that makes it executable, and a check that stops existing under that name turns the build red rather than leaving a published claim standing. SOC 2: not certified and not claimed; the control roadmap maps to the mechanisms above and a formal program begins once the legal entity exists (honest pilot-stage disclosure, per our own rule against implying certifications that don't exist).

The inventory

• Every workspace read passes one ownership funnel — not-found and not-owned are the same 404

  tests/workspace-guard.test.ts · tests/workspace-isolation.test.ts

• Share links are the only sanctioned non-owner read: 256-bit tokens, hashed at rest, always expiring, no revocation oracle

  tests/share-links.test.ts

• Shared and demo renders carry no mutation affordance, no workspace id and no customer free text

  tests/view-tripwire.test.tsx

• Uploads parse in the browser and transmit only whitelisted normalized rows; the server re-validates with the same rules

  tests/upload-boundary.test.ts

• Telemetry rows carry no end-user identifiers — the schema refuses them at the parser

  tests/pii-confinement.test.ts

• Every surface of one workspace state shows the same ledger version — figures cannot silently diverge between page, export and decision record

  tests/ledger-version.test.tsx

• The engine's output is byte-identical across runs on both committed datasets

  tests/catalog-golden.test.ts · tests/ledger-goldens.test.ts

• No client bundle carries secret values, and anonymous routes ship no authentication vendor code

  scripts/check-bundle-secrets.mjs · scripts/check-public-bundle.mjs

Clone the repository access we grant during a pilot review and run pnpm vitest run; every line above executes. Nothing on this page is a control we intend to build.

Incident response & auditability

Every unhandled server error is logged as one structured line, digest first — the same reference the error page shows you, so a report maps to a stack trace. A health endpoint gates every deploy, and each deploy is reversible to the previous build. Every recommendation exports a canonical decision record (JSON) so any displayed figure can be independently reproduced — the engine is deterministic, with no LLM in the decision path. Security reports: Contact — acknowledged within 48 hours. The same contact is published machine-readably at /.well-known/security.txt (RFC 9116).

EU residency posture

Telemetry and derived analysis are stored and processed in the EU (Amsterdam/Frankfurt). The 2 exceptions are dns, tls and edge delivery (Cloudflare), authentication and sso (Clerk), which may process account metadata outside the EU — named above, nothing silent.