Legal

Data Processing Terms & Subprocessors

Effective September 20, 2026 · Bright Beam International, Inc.

How Beam processes personal data on your behalf as a processor or service provider: our obligations, the subprocessors we use, how data leaves the EU/UK lawfully, and the security measures in place.

1. Scope and roles

These Data Processing Terms ("DPA") form part of the Terms of Service between Bright Beam International, Inc. ("Processor") and the Customer ("Controller") and apply whenever we process personal data contained in Customer Data on the Customer's behalf. They are designed to satisfy Article 28 of the GDPR and UK GDPR, the "service provider" requirements of the CCPA/CPRA, and the processor requirements of other US state privacy laws.

Where the Customer is itself a processor for its own clients, we act as sub-processor and the Customer warrants that its instructions are authorized by the relevant controller.

2. Details of processing

Item	Description
Subject matter	Provision of the Beam.expert AI workspace.
Duration	The subscription term plus the export and deletion periods in the Terms.
Nature and purpose	Hosting, storage, retrieval, AI generation (text, embeddings, images), workflow execution, approved actions in connected applications, support.
Categories of data subjects	Customer's employees and contractors; Customer's customers, prospects, and business contacts whose data appears in uploaded knowledge, evidence, drafts, or connected-app actions.
Categories of personal data	Names, business contact details, job titles, correspondence, and any other personal data the Customer chooses to include. Special-category data is not intended and should not be submitted.

3. Processor obligations

Process personal data only on the Customer's documented instructions, which are the Terms, this DPA, and the Customer's use of the Service's features. We will inform the Customer if we believe an instruction infringes data-protection law.
Ensure persons authorized to process personal data are bound by confidentiality and receive appropriate training.
Implement the technical and organizational measures described below and review them regularly.
Engage subprocessors only under written terms imposing equivalent obligations, and remain liable for their performance.
Assist the Customer with data-subject requests, data-protection impact assessments, and consultations with supervisory authorities, taking into account the nature of processing.
Notify the Customer without undue delay, and within 72 hours of confirmation, of a personal-data breach affecting Customer Data, with the information reasonably available to us.
Delete or return Customer Data at the end of the Service as described in the Terms, unless retention is required by law.
Make available the information necessary to demonstrate compliance and allow audits, as described below.
Not sell, share for cross-context behavioral advertising, or retain, use, or disclose Customer Data for any purpose other than providing the Service, and not combine it with data from other sources except as permitted for service providers under the CCPA.
Not train machine-learning models on Customer Data, and contractually prohibit our AI providers from doing so.

4. Subprocessors

We use the following subprocessors. We will notify workspace owners by email at least 30 days before adding or replacing a subprocessor that processes Customer Data. The Customer may object on reasonable data-protection grounds within that period; if we cannot address the objection, the Customer may terminate the affected Service with a pro-rata refund of prepaid fees.

Category	Purpose	Data	Location
Cloud hosting and content delivery	Runs the application, serverless functions, edge network, and file storage; routes model requests to AI providers.	All application traffic; uploaded files; prompts and outputs in transit.	United States (global edge network)
AI model providers	Large language, embedding, and image models used to generate responses, retrieve knowledge, and create images.	Prompts, retrieved knowledge excerpts, agent instructions, and generated outputs. Requests are sent with provider-side storage disabled and under terms that prohibit training on customer data.	United States
Managed database	Primary encrypted storage for accounts, workspaces, agents, workflows, knowledge, run history, billing records, and audit events.	Account and workspace data at rest.	United States
Connected-app authorization provider	Handles OAuth authorization and tool execution for the third-party applications you connect; holds OAuth tokens on our behalf.	Connection identifiers, OAuth tokens, and the arguments and results of actions you approve.	United States
Payment processor	Payment processing, subscriptions, invoices, tax calculation, and the customer billing portal.	Billing contact, payment method (held only by the processor; Beam never stores card numbers), transaction history.	United States
Transactional email provider	Delivers verification, password reset, team invitation, and billing emails.	Email address, name, and the content of transactional messages.	United States
Applications you connect	Only when you connect a third-party application (email, calendar, documents, spreadsheets): acts on your account under your authorization.	Data you choose to send to or read from the connected application through approved actions.	Per application

The named vendor for each category, with its data-protection terms and security certifications, is provided to Customers on request to legal@beam.expert and, where a vendor requires it, under confidentiality. Applications the Customer connects are recipients rather than subprocessors: they receive data only through actions the Customer's users approve in their own accounts.

5. International transfers

Customer Data is processed in the United States. For Customers subject to the GDPR, UK GDPR, or Swiss FADP, the parties enter into the EU Standard Contractual Clauses (2021/914) Module 2 or 3 as applicable, with the UK Addendum and Swiss adaptations, which are incorporated by reference and available on request from privacy@beam.expert. We apply supplementary measures including encryption in transit and at rest, access controls, and a policy of challenging government requests for data.

6. Technical and organizational measures

Area	Measures
Encryption	TLS 1.2+ for all traffic; AES-256 encryption at rest for the database, file storage, and backups; encrypted reasoning transport for model requests.
Access control	Role-based access (owner, admin, member, viewer) enforced server-side on every request; tenant isolation on every database query; signed, time-limited state for OAuth flows with user verification; least-privilege staff access with MFA.
Authentication	Hashed passwords (scrypt), session cookies with HttpOnly/Secure/SameSite, email verification, password-reset tokens that expire in one hour and revoke other sessions.
AI safeguards	Provider-side storage disabled; no training on Customer Data; tenant-scoped retrieval; approval gate on every external action; idempotent execution to prevent duplicate sends.
Logging and monitoring	Immutable audit events for agent runs, approvals, connections, billing, and team changes; AI telemetry limited to metadata (no prompt or output text); alerting on repeated failures.
Availability	Managed, replicated database with point-in-time recovery; serverless hosting with automatic failover across regions; daily encrypted backups retained 35 days.
Secure development	Type-checked codebase, automated tests on billing, connections, and agent runtime, dependency vulnerability scanning, pinned dependency versions with release-age policy, code review for all changes.
Incident response	Documented response process; customer notification within 72 hours of confirmed breach; post-incident review.
Vendor management	Written data-protection terms with every subprocessor; annual review of subprocessor certifications (SOC 2 / ISO 27001 where available).

7. Audits and information

On written request no more than once per year (or after a confirmed breach), we will provide our latest security documentation, subprocessor certifications, and completed security questionnaires. If those do not reasonably satisfy the Customer's legal obligations, the Customer may conduct an audit during business hours, with 30 days' notice, under confidentiality, at its own cost, and without disrupting the Service or exposing other customers' data.

8. Data-subject and consumer requests

Workspace owners and admins can fulfill most requests directly: export or delete documents, drafts, and runs; remove team members; delete the workspace. If we receive a request directly from a data subject about Customer Data, we will redirect them to the Customer and, where the Customer asks, help respond within the legal deadline.

9. Contact

Data-protection inquiries: privacy@beam.expert. Bright Beam International, Inc., 2219 Main St, Santa Monica, CA 90405, United States. To request a signed copy of this DPA and the Standard Contractual Clauses, email legal@beam.expert.

Preparing workspace

Back to Beam.expert