Strict multi-tenancy
Each organization owns its data, pipelines, secrets, and LLM keys. No cache, no table, no file path is shared without an explicit flag.
Security & compliance
The standard your auditorsexpect.
betool is built for environments where every access, every execution, every debit must be traceable, justifiable, and revocable.
Principles
Four non-negotiables.
They apply to every line of code, every migration, every module.
Mandatory audit of cross-tenant access
Any read of user content by an agent belonging to another organization (e.g. platform operator) requires client-side opt-in, instantly revocable, logged on every access.
Cascading refusal if audit is unavailable
Strict policy: no read without a trace. If logging fails, the operation is refused. No window where an access would pass without an audit trail.
Model sovereignty (BYOK)
Your Anthropic, OpenAI or Google Gemini API keys. Or private models (Ollama, vLLM) on your infrastructure. Your keys remain isolated to your organization.
Compliance
Frameworks & controls.
GDPR
Article 15 (right of access), article 17 (right to erasure), article 30 (records of processing). Exportable per organization.
Encryption
TLS 1.3 in transit. At-rest encryption on databases and object storage. Platform secrets in a dedicated vault (Secret Manager / KMS); your integration credentials stored in the database, never displayed again.
EU hosting
Platform and database hosted in Paris (Google Cloud, europe-west9). Dedicated deployment (private client cloud, on-premise) on request on Enterprise.
ISO 27001
Certification targeted, not obtained to date. Incident management and access review procedures in place.
SSO & provisioning
Fine-grained roles per organization. SSO (OIDC / SAML) and SCIM provisioning upon assessment on Enterprise.
Penetration testing
A penetration test by an independent third party can be conducted as part of an Enterprise contract.
Technical guardrails
Integrity, with no blind spots.
The invariants below are enforced by the database and the runtime, not merely by convention.
- No migration auto-applied at boot — every schema change goes through review.
- Automatic database backups, with regional high availability.
- Execution sandbox per organization: operators can only reach the resources you have explicitly wired.
- Closed vocabulary for audited entities (CHECK constraints + application whitelist): no surprise entries in the audit log.
- Pre-call refusal on insufficient balance — no side effects before a confirmed debit.
- Invariant counters per exchange: no double-charge, uniqueness constraint at the database level.
Deployment
Hosted in France by default.
Multi-tenant SaaS hosted in Paris is the format available today. Dedicated deployments are assessed case by case, based on your hosting constraints.
Managed multi-tenant (Paris)
betool cloud, Google Cloud europe-west9. Strict per-organization isolation. Available as soon as your account is created.
Private client cloud
Dedicated instance on your cloud tenant. Network and secrets under your control. On request.
On-premise
On your infrastructure. On request.
Air-gapped
No outbound internet connectivity. Private LLM models required. Available on request.
A security question, an audit to prepare?
Our security dossier covers architecture, controls, incident management, and continuity.