betool is designed for regulated environments. Security is not a layer bolted on after the fact: it is the invariant that shapes every line of code, every migration, every module.
1. Strict multi-tenancy
Every organisation owns its own data, pipelines, secrets, files and LLM keys. Isolation is enforced:
- At the database level — every business table carries an indexed
org_idcolumn, and server-side queries always filter by the session organisation. - At the filesystem level — each org has its own root under
<data_root>/orgs/<org_id>/. No shared paths. - At the cache level — per-org caches; no shared entry without an explicit
is_shared = TRUEflag. - At the secrets level — each org has its own API keys and tokens, stored server-side and never returned in plaintext. No global fallback. Secrets entered in a node's configuration (HMAC secret, token, password) are also masked wherever the configuration is read back — editor, API, MCP tools read by an AI, proposals.
2. Mandatory audit of cross-tenant access
Certain roles (typically platform-operator accounts on the vendor side) may need to access another organisation's content for support purposes. Such access is:
- Gated on an opt-in from the target organisation — revocable at any time from the admin panel.
- Logged on every access — dedicated audit table, scoped by target org, exposed to customers via
GET /api/admin/me/supervisor-reads. - Denied if the audit write fails — no read without a trace.
See GDPR Audit.
3. Motivated refusal on destructive operations
Any operation that destroys or replaces another organisation's content (REPLACE-IN-PLACE of children, DELETE) is refused if the target org has not activated the read opt-in. Rationale: without visibility, the operator would be proposing a payload that could blindly overwrite existing content.
4. LLM model sovereignty
- Native BYOK — your OpenAI, Anthropic and Google keys are managed by your organisation. No cross-org leakage. BYOK is optional (managed models exist, billed in credits) but recommended in regulated environments.
- Private models — Ollama, LM Studio or any OpenAI-compatible endpoint (vLLM…) hosted on your own hardware or in your private cloud. Prompts and completions never leave your perimeter.
- No silent shared pool — if an org uses a shared model, that is an explicit decision with access control.
Engineering posture
Our standard is precision: maximum robustness, total observability, determinism, anti-hallucination, anti-regression, tests at every turn.
Concretely, at every architecture / code / prompt trade-off:
| Choice | Expected choice | Why |
|---|---|---|
| Latency × 2 vs. abbreviated reasoning | × 2 | Lost precision is paid back in user trust |
| Fine-grained observability vs. essential logs only | Fine-grained | Without visibility, debugging is blind |
| Shortcut that degrades a behaviour | Refusal | Behavioural risk is measured in customer incidents |
Mantra: "If someone finds a bug, it means we didn't have enough guardrails, not too many."