[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-\u002Fen\u002Fdocs\u002Fsecurite\u002Fprincipes":3,"docs-nav-en":435},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"body":10,"_type":429,"_id":430,"_source":431,"_file":432,"_stem":433,"_extension":434},"\u002Fen\u002Fdocs\u002Fsecurite\u002Fprincipes","securite",false,"","Security principles","betool's four non-negotiable commitments: strict multi-tenancy, audited cross-tenant access, justified refusal of destructive operations, sovereign LLMs.",{"type":11,"children":12,"toc":420},"root",[13,29,36,48,132,138,150,191,204,210,222,228,261,267,283,288,375,385,391],{"type":14,"tag":15,"props":16,"children":17},"element","p",{},[18,21,27],{"type":19,"value":20},"text","betool is designed for ",{"type":14,"tag":22,"props":23,"children":24},"strong",{},[25],{"type":19,"value":26},"regulated environments",{"type":19,"value":28},". Security is not a layer bolted on after the fact: it is the invariant that shapes every line of code, every migration, every module.",{"type":14,"tag":30,"props":31,"children":33},"h2",{"id":32},"_1-strict-multi-tenancy",[34],{"type":19,"value":35},"1. Strict multi-tenancy",{"type":14,"tag":15,"props":37,"children":38},{},[39,41,46],{"type":19,"value":40},"Every organisation owns ",{"type":14,"tag":22,"props":42,"children":43},{},[44],{"type":19,"value":45},"its own",{"type":19,"value":47}," data, pipelines, secrets, files and LLM keys. Isolation is enforced:",{"type":14,"tag":49,"props":50,"children":51},"ul",{},[52,79,97,115],{"type":14,"tag":53,"props":54,"children":55},"li",{},[56,61,63,70,72,77],{"type":14,"tag":22,"props":57,"children":58},{},[59],{"type":19,"value":60},"At the database level",{"type":19,"value":62}," — every business table carries an indexed ",{"type":14,"tag":64,"props":65,"children":67},"code",{"className":66},[],[68],{"type":19,"value":69},"org_id",{"type":19,"value":71}," column, and server-side queries ",{"type":14,"tag":22,"props":73,"children":74},{},[75],{"type":19,"value":76},"always",{"type":19,"value":78}," filter by the session organisation.",{"type":14,"tag":53,"props":80,"children":81},{},[82,87,89,95],{"type":14,"tag":22,"props":83,"children":84},{},[85],{"type":19,"value":86},"At the filesystem level",{"type":19,"value":88}," — each org has its own root under ",{"type":14,"tag":64,"props":90,"children":92},{"className":91},[],[93],{"type":19,"value":94},"\u003Cdata_root>\u002Forgs\u002F\u003Corg_id>\u002F",{"type":19,"value":96},". No shared paths.",{"type":14,"tag":53,"props":98,"children":99},{},[100,105,107,113],{"type":14,"tag":22,"props":101,"children":102},{},[103],{"type":19,"value":104},"At the cache level",{"type":19,"value":106}," — per-org caches; no shared entry without an explicit ",{"type":14,"tag":64,"props":108,"children":110},{"className":109},[],[111],{"type":19,"value":112},"is_shared = TRUE",{"type":19,"value":114}," flag.",{"type":14,"tag":53,"props":116,"children":117},{},[118,123,125,130],{"type":14,"tag":22,"props":119,"children":120},{},[121],{"type":19,"value":122},"At the secrets level",{"type":19,"value":124}," — each org has its own API keys and tokens, stored server-side and never returned in plaintext. No global fallback. Secrets entered in a node's configuration (HMAC secret, token, password) are also ",{"type":14,"tag":22,"props":126,"children":127},{},[128],{"type":19,"value":129},"masked wherever the configuration is read back",{"type":19,"value":131}," — editor, API, MCP tools read by an AI, proposals.",{"type":14,"tag":30,"props":133,"children":135},{"id":134},"_2-mandatory-audit-of-cross-tenant-access",[136],{"type":19,"value":137},"2. Mandatory audit of cross-tenant access",{"type":14,"tag":15,"props":139,"children":140},{},[141,143,148],{"type":19,"value":142},"Certain roles (typically platform-operator accounts on the vendor side) ",{"type":14,"tag":22,"props":144,"children":145},{},[146],{"type":19,"value":147},"may",{"type":19,"value":149}," need to access another organisation's content for support purposes. Such access is:",{"type":14,"tag":49,"props":151,"children":152},{},[153,163,181],{"type":14,"tag":53,"props":154,"children":155},{},[156,161],{"type":14,"tag":22,"props":157,"children":158},{},[159],{"type":19,"value":160},"Gated on an opt-in from the target organisation",{"type":19,"value":162}," — revocable at any time from the admin panel.",{"type":14,"tag":53,"props":164,"children":165},{},[166,171,173,179],{"type":14,"tag":22,"props":167,"children":168},{},[169],{"type":19,"value":170},"Logged on every access",{"type":19,"value":172}," — dedicated audit table, scoped by target org, exposed to customers via ",{"type":14,"tag":64,"props":174,"children":176},{"className":175},[],[177],{"type":19,"value":178},"GET \u002Fapi\u002Fadmin\u002Fme\u002Fsupervisor-reads",{"type":19,"value":180},".",{"type":14,"tag":53,"props":182,"children":183},{},[184,189],{"type":14,"tag":22,"props":185,"children":186},{},[187],{"type":19,"value":188},"Denied if the audit write fails",{"type":19,"value":190}," — no read without a trace.",{"type":14,"tag":15,"props":192,"children":193},{},[194,196,203],{"type":19,"value":195},"See ",{"type":14,"tag":197,"props":198,"children":200},"a",{"href":199},"\u002Fen\u002Fdocs\u002Fsecurite\u002Faudit-rgpd",[201],{"type":19,"value":202},"GDPR Audit",{"type":19,"value":180},{"type":14,"tag":30,"props":205,"children":207},{"id":206},"_3-motivated-refusal-on-destructive-operations",[208],{"type":19,"value":209},"3. Motivated refusal on destructive operations",{"type":14,"tag":15,"props":211,"children":212},{},[213,215,220],{"type":19,"value":214},"Any operation that destroys or replaces another organisation's content (REPLACE-IN-PLACE of children, DELETE) is ",{"type":14,"tag":22,"props":216,"children":217},{},[218],{"type":19,"value":219},"refused",{"type":19,"value":221}," if the target org has not activated the read opt-in. Rationale: without visibility, the operator would be proposing a payload that could blindly overwrite existing content.",{"type":14,"tag":30,"props":223,"children":225},{"id":224},"_4-llm-model-sovereignty",[226],{"type":19,"value":227},"4. LLM model sovereignty",{"type":14,"tag":49,"props":229,"children":230},{},[231,241,251],{"type":14,"tag":53,"props":232,"children":233},{},[234,239],{"type":14,"tag":22,"props":235,"children":236},{},[237],{"type":19,"value":238},"Native BYOK",{"type":19,"value":240}," — your OpenAI, Anthropic and Google keys are managed by your organisation. No cross-org leakage. BYOK is optional (managed models exist, billed in credits) but recommended in regulated environments.",{"type":14,"tag":53,"props":242,"children":243},{},[244,249],{"type":14,"tag":22,"props":245,"children":246},{},[247],{"type":19,"value":248},"Private models",{"type":19,"value":250}," — Ollama, LM Studio or any OpenAI-compatible endpoint (vLLM…) hosted on your own hardware or in your private cloud. Prompts and completions never leave your perimeter.",{"type":14,"tag":53,"props":252,"children":253},{},[254,259],{"type":14,"tag":22,"props":255,"children":256},{},[257],{"type":19,"value":258},"No silent shared pool",{"type":19,"value":260}," — if an org uses a shared model, that is an explicit decision with access control.",{"type":14,"tag":30,"props":262,"children":264},{"id":263},"engineering-posture",[265],{"type":19,"value":266},"Engineering posture",{"type":14,"tag":268,"props":269,"children":270},"blockquote",{},[271],{"type":14,"tag":15,"props":272,"children":273},{},[274,276,281],{"type":19,"value":275},"Our standard is ",{"type":14,"tag":22,"props":277,"children":278},{},[279],{"type":19,"value":280},"precision",{"type":19,"value":282},": maximum robustness, total observability, determinism, anti-hallucination, anti-regression, tests at every turn.",{"type":14,"tag":15,"props":284,"children":285},{},[286],{"type":19,"value":287},"Concretely, at every architecture \u002F code \u002F prompt trade-off:",{"type":14,"tag":289,"props":290,"children":291},"table",{},[292,316],{"type":14,"tag":293,"props":294,"children":295},"thead",{},[296],{"type":14,"tag":297,"props":298,"children":299},"tr",{},[300,306,311],{"type":14,"tag":301,"props":302,"children":303},"th",{},[304],{"type":19,"value":305},"Choice",{"type":14,"tag":301,"props":307,"children":308},{},[309],{"type":19,"value":310},"Expected choice",{"type":14,"tag":301,"props":312,"children":313},{},[314],{"type":19,"value":315},"Why",{"type":14,"tag":317,"props":318,"children":319},"tbody",{},[320,339,357],{"type":14,"tag":297,"props":321,"children":322},{},[323,329,334],{"type":14,"tag":324,"props":325,"children":326},"td",{},[327],{"type":19,"value":328},"Latency × 2 vs. abbreviated reasoning",{"type":14,"tag":324,"props":330,"children":331},{},[332],{"type":19,"value":333},"× 2",{"type":14,"tag":324,"props":335,"children":336},{},[337],{"type":19,"value":338},"Lost precision is paid back in user trust",{"type":14,"tag":297,"props":340,"children":341},{},[342,347,352],{"type":14,"tag":324,"props":343,"children":344},{},[345],{"type":19,"value":346},"Fine-grained observability vs. essential logs only",{"type":14,"tag":324,"props":348,"children":349},{},[350],{"type":19,"value":351},"Fine-grained",{"type":14,"tag":324,"props":353,"children":354},{},[355],{"type":19,"value":356},"Without visibility, debugging is blind",{"type":14,"tag":297,"props":358,"children":359},{},[360,365,370],{"type":14,"tag":324,"props":361,"children":362},{},[363],{"type":19,"value":364},"Shortcut that degrades a behaviour",{"type":14,"tag":324,"props":366,"children":367},{},[368],{"type":19,"value":369},"Refusal",{"type":14,"tag":324,"props":371,"children":372},{},[373],{"type":19,"value":374},"Behavioural risk is measured in customer incidents",{"type":14,"tag":15,"props":376,"children":377},{},[378,383],{"type":14,"tag":22,"props":379,"children":380},{},[381],{"type":19,"value":382},"Mantra",{"type":19,"value":384},": \"If someone finds a bug, it means we didn't have enough guardrails, not too many.\"",{"type":14,"tag":30,"props":386,"children":388},{"id":387},"further-reading",[389],{"type":19,"value":390},"Further reading",{"type":14,"tag":49,"props":392,"children":393},{},[394,403,411],{"type":14,"tag":53,"props":395,"children":396},{},[397],{"type":14,"tag":197,"props":398,"children":400},{"href":399},"\u002Fen\u002Fdocs\u002Fsecurite\u002Fmulti-tenant",[401],{"type":19,"value":402},"Strict multi-tenancy",{"type":14,"tag":53,"props":404,"children":405},{},[406],{"type":14,"tag":197,"props":407,"children":408},{"href":199},[409],{"type":19,"value":410},"GDPR audit & access log",{"type":14,"tag":53,"props":412,"children":413},{},[414],{"type":14,"tag":197,"props":415,"children":417},{"href":416},"\u002Fen\u002Fdocs\u002Fsecurite\u002Fdeploiement-souverain",[418],{"type":19,"value":419},"Sovereign deployment",{"title":7,"searchDepth":421,"depth":421,"links":422},2,[423,424,425,426,427,428],{"id":32,"depth":421,"text":35},{"id":134,"depth":421,"text":137},{"id":206,"depth":421,"text":209},{"id":224,"depth":421,"text":227},{"id":263,"depth":421,"text":266},{"id":387,"depth":421,"text":390},"markdown","content:en:docs:5.securite:1.principes.md","content","en\u002Fdocs\u002F5.securite\u002F1.principes.md","en\u002Fdocs\u002F5.securite\u002F1.principes","md",[436],{"title":437,"_path":438,"children":439},"En","\u002Fen",[440],{"title":441,"_path":442,"children":443},"Docs","\u002Fen\u002Fdocs",[444,457,485,513,526,534,547,608],{"title":445,"_path":446,"children":447},"Getting started","\u002Fen\u002Fdocs\u002Fdemarrer",[448,451,454],{"title":449,"_path":450},"Welcome","\u002Fen\u002Fdocs\u002Fdemarrer\u002Fbienvenue",{"title":452,"_path":453},"Create an account","\u002Fen\u002Fdocs\u002Fdemarrer\u002Fcreer-un-compte",{"title":455,"_path":456},"Connect an LLM key","\u002Fen\u002Fdocs\u002Fdemarrer\u002Fbrancher-llm",{"title":458,"_path":459,"children":460},"Channels","\u002Fen\u002Fdocs\u002Fcanaux",[461,464,467,470,473,476,479,482],{"title":462,"_path":463},"Channels overview","\u002Fen\u002Fdocs\u002Fcanaux\u002Fvue-densemble",{"title":465,"_path":466},"Real-time telephony","\u002Fen\u002Fdocs\u002Fcanaux\u002Ftelephone",{"title":468,"_path":469},"Email","\u002Fen\u002Fdocs\u002Fcanaux\u002Femail",{"title":471,"_path":472},"Web chat widget","\u002Fen\u002Fdocs\u002Fcanaux\u002Fchat-widget",{"title":474,"_path":475},"HTTP Webhook","\u002Fen\u002Fdocs\u002Fcanaux\u002Fwebhook",{"title":477,"_path":478},"Messaging (WhatsApp, Messenger, Telegram, Mattermost)","\u002Fen\u002Fdocs\u002Fcanaux\u002Fmessageries",{"title":480,"_path":481},"Meta Lead Ads","\u002Fen\u002Fdocs\u002Fcanaux\u002Ffacebook-leads",{"title":483,"_path":484},"Schedule (cron)","\u002Fen\u002Fdocs\u002Fcanaux\u002Fschedule",{"title":486,"_path":487,"children":488},"Pipelines","\u002Fen\u002Fdocs\u002Fpipelines",[489,492,495,498,501,504,507,510],{"title":490,"_path":491},"The Visual Editor","\u002Fen\u002Fdocs\u002Fpipelines\u002Fediteur-visuel",{"title":493,"_path":494},"AI Agents","\u002Fen\u002Fdocs\u002Fpipelines\u002Fagents",{"title":496,"_path":497},"Deterministic Operators","\u002Fen\u002Fdocs\u002Fpipelines\u002Foperateurs",{"title":499,"_path":500},"Flow Control","\u002Fen\u002Fdocs\u002Fpipelines\u002Fcontrole-flux",{"title":502,"_path":503},"Code Steps","\u002Fen\u002Fdocs\u002Fpipelines\u002Fcode-step",{"title":505,"_path":506},"Sub-pipelines","\u002Fen\u002Fdocs\u002Fpipelines\u002Fsous-pipelines",{"title":508,"_path":509},"No-code actions","\u002Fen\u002Fdocs\u002Fpipelines\u002Factions-no-code",{"title":511,"_path":512},"Knowledge base","\u002Fen\u002Fdocs\u002Fpipelines\u002Fbase-de-connaissances",{"title":514,"_path":515,"children":516},"Supervision","\u002Fen\u002Fdocs\u002Fsupervision",[517,520,523],{"title":518,"_path":519},"Execution History","\u002Fen\u002Fdocs\u002Fsupervision\u002Fexecutions",{"title":521,"_path":522},"Credits & Metering","\u002Fen\u002Fdocs\u002Fsupervision\u002Fcredits-metering",{"title":524,"_path":525},"Benchmarks","\u002Fen\u002Fdocs\u002Fsupervision\u002Fbenchmarks",{"title":527,"_path":528,"children":529},"Security","\u002Fen\u002Fdocs\u002Fsecurite",[530,531,532,533],{"title":8,"_path":4},{"title":402,"_path":399},{"title":410,"_path":199},{"title":419,"_path":416},{"title":535,"_path":536,"children":537},"Developers","\u002Fen\u002Fdocs\u002Fdeveloppeurs",[538,541,544],{"title":539,"_path":540},"Admin API","\u002Fen\u002Fdocs\u002Fdeveloppeurs\u002Fapi-admin",{"title":542,"_path":543},"Outbound webhooks","\u002Fen\u002Fdocs\u002Fdeveloppeurs\u002Fwebhooks-sortants",{"title":545,"_path":546},"Drive betool from Claude (MCP)","\u002Fen\u002Fdocs\u002Fdeveloppeurs\u002Fmcp",{"title":548,"_path":549,"children":550},"Integrations","\u002Fen\u002Fdocs\u002Fintegrations",[551,554,557,560,563,566,569,572,575,578,581,584,587,590,593,596,599,602,605],{"title":552,"_path":553},"Integrations overview","\u002Fen\u002Fdocs\u002Fintegrations\u002Fvue-densemble",{"title":555,"_path":556},"Stripe","\u002Fen\u002Fdocs\u002Fintegrations\u002Fstripe",{"title":558,"_path":559},"GitHub","\u002Fen\u002Fdocs\u002Fintegrations\u002Fgithub",{"title":561,"_path":562},"Google","\u002Fen\u002Fdocs\u002Fintegrations\u002Fgoogle",{"title":564,"_path":565},"LinkedIn Ads","\u002Fen\u002Fdocs\u002Fintegrations\u002Flinkedin-ads",{"title":567,"_path":568},"Kavkom","\u002Fen\u002Fdocs\u002Fintegrations\u002Fkavkom",{"title":570,"_path":571},"Jira","\u002Fen\u002Fdocs\u002Fintegrations\u002Fjira",{"title":573,"_path":574},"Slack","\u002Fen\u002Fdocs\u002Fintegrations\u002Fslack",{"title":576,"_path":577},"SMS","\u002Fen\u002Fdocs\u002Fintegrations\u002Fsms",{"title":579,"_path":580},"Enable Banking (open banking)","\u002Fen\u002Fdocs\u002Fintegrations\u002Fenable-banking",{"title":582,"_path":583},"CRM, marketing & productivity","\u002Fen\u002Fdocs\u002Fintegrations\u002Fcrm-marketing",{"title":585,"_path":586},"HeyGen (video)","\u002Fen\u002Fdocs\u002Fintegrations\u002Fheygen",{"title":588,"_path":589},"La Poste","\u002Fen\u002Fdocs\u002Fintegrations\u002Fla-poste",{"title":591,"_path":592},"Industry CRM (beTool Application, Qhare)","\u002Fen\u002Fdocs\u002Fintegrations\u002Fcrm-metier",{"title":594,"_path":595},"Mitti (field inspections)","\u002Fen\u002Fdocs\u002Fintegrations\u002Fmitti",{"title":597,"_path":598},"Meta (Messenger, Pages, Meta Ads)","\u002Fen\u002Fdocs\u002Fintegrations\u002Fmeta",{"title":600,"_path":601},"Onoff Business (Beta)","\u002Fen\u002Fdocs\u002Fintegrations\u002Fonoff",{"title":603,"_path":604},"Smart Life \u002F Tuya (connected devices)","\u002Fen\u002Fdocs\u002Fintegrations\u002Fsmart-life",{"title":606,"_path":607},"beTool products (Desktop, Kiosk, Terminal)","\u002Fen\u002Fdocs\u002Fintegrations\u002Fproduits-betool",{"title":609,"_path":610,"children":611},"Use cases","\u002Fen\u002Fdocs\u002Fcas-usage",[612,615,618,621,624,627],{"title":613,"_path":614},"Typical business agents","\u002Fen\u002Fdocs\u002Fcas-usage\u002Fvue-densemble",{"title":616,"_path":617},"CFO IA","\u002Fen\u002Fdocs\u002Fcas-usage\u002Fcfo-ia",{"title":619,"_path":620},"COO IA","\u002Fen\u002Fdocs\u002Fcas-usage\u002Fcoo-ia",{"title":622,"_path":623},"CTO IA","\u002Fen\u002Fdocs\u002Fcas-usage\u002Fcto-ia",{"title":625,"_path":626},"Product Manager IA","\u002Fen\u002Fdocs\u002Fcas-usage\u002Fproduct-manager-ia",{"title":628,"_path":629},"Personal assistant","\u002Fen\u002Fdocs\u002Fcas-usage\u002Fassistant-personnel"]