Security, stated plainly.

Privacy per person

A private Beni for each person

Your DMs go to your own Beni, with its own memory and its own workspace. The team Beni and other people's Benis can't read them. Team channels are shared knowledge, and Beni treats them that way.

In place (pilot)

Separate live panels and browsers

Each person's live panel and browser belong to their own scope. A link to your private panel shows nothing of anyone else's, and a team link shows only team work.

In place (pilot)

Your accounts stay yours

Each person connects their own tools. Mail, calendar and files are private by default and warn before they are shared with the team.

Rolling out

Approvals and access

Approval cards for every write

Before Beni writes to a shared tool, it posts a card. Only the person who asked, or an admin, can approve it; in our tests another member's click was refused.

In place (pilot)

Approve and always allow

A third button on the card makes that one action automatic on the account it ran on. Only that account's owner or an admin can choose it, and an admin's rules still come first.

In place (pilot)

Buttons, not words

Typing "approve" in the chat does nothing. Each card carries a one-time ticket that only a click on that card can use, and it expires.

In place (pilot)

A broker between Beni and your apps

Beni never holds your app tokens. Each call goes through our broker with a signed record of who asked, which the broker checks (signature, age, agent, tool, unchanged parameters, no replay) before applying your settings.

In place (pilot)

Off, Read, or Read and write

For each connected app, and for each area inside it such as mail or files, you choose Off, Read, or Read and write. Each action can be automatic, ask first, or off. Writes never start as automatic.

In place (pilot)

Encrypted tokens

App tokens are stored encrypted (AES-256-GCM), with the key kept apart from the data.

In place (pilot)

Tamper-evident audit log

Every app call, approval, denial and admin change is written to an audit log in which each entry is chained to the hash of the one before, so an edited or deleted row is detected. The chain isn't anchored outside our server, so it can't rule out someone with full control of that server rewriting the whole log. Parameters are stored only as a hash, never as text.

In place (pilot)

Asks before it connects

When a request needs an app you haven't connected, Beni says so in one line and offers the apps that can do the job, such as "I need your Outlook or Gmail for this. Connect one?" You connect it yourself, or use another way.

Live in Benigo

Admin controls

Workspace admins get one Admin page for the switches below. Every change made there is written to the audit log. These controls work in the Benigo workspace today; Slack and Teams don't have them yet.

Rules for what asks first

Admins choose which app actions need approval across the workspace: every write, every read, or named actions. They can also switch named actions off. These rules only make things stricter: they override anyone's "always allow" and never loosen a person's own settings.

Live in Benigo

Pause one person's Beni

While paused, Beni starts nothing for that person and answers with one line saying an admin paused it, with the admin's reason if one was given. Everyone else keeps working.

Live in Benigo

Stop a running task

Stop blocks the next step of everything Beni is doing for a person right now and drops the reply it was about to send. It can't take back what an app already did: a sent email stays sent.

Live in Benigo

Who Beni may message

Admins choose who Beni may message directly: anyone, only listed people, or nobody, ready for when Beni starts conversations. Beni can always answer the person talking to it.

Live in Benigo

Audit export and API

Admins download the audit log as CSV or JSON lines, or let a program read it through an API with filters by date, event, person and app. Programs use a read-only token that is shown once, stored only as a hash, can be revoked and shows when it was last used. Every response says whether the hash chain is intact, and every export is itself logged.

Live in Benigo

Memory and deletion

Memory off for a channel or the workspace

An admin can turn Beni's long-term memory off for one channel or everywhere. Beni stops recording those messages, moves what it had recorded out of the folders it searches, and can't save anything from those conversations to its memory.

Live in Benigo

"@beni forget this"

Reply in a thread and Beni removes that thread, the first message and every reply, from the channel's memory, never records it again and tells you how many messages it removed. Notes Beni wrote in its own words aren't edited; it says so, and you can ask it to check them.

Live in Benigo

Clean workspace

An admin can delete Beni's memory, channel logs, workspace files and conversation transcripts in one go. Beni's instructions, connections, credits and the audit log are kept. The admin confirms by typing "wipe" and the workspace name within 10 minutes, and the request, the confirmation and how many items were deleted go into the audit log.

Live in Benigo

Isolation

A sandbox per agent

Each Beni runs its tools in its own container with no network, no added privileges, memory and process limits, and access only to its own workspace folder.

In place (pilot)

gVisor

Sandboxes and browsers run under gVisor, a second kernel boundary between the agent and our servers.

In place (pilot)

A browser per agent, behind an egress filter

Each agent's browser runs in its own container on a network with no direct route out. Its traffic goes through a proxy that refuses private, internal and cloud-metadata addresses, so a web page can't reach our services or another agent's browser.

In place (pilot)

No agent controls the server

No agent process holds the server's container controls. A small, locked-down service starts only approved images with forced limits and refuses everything else.

In place (pilot)

One environment per customer

Separate servers or virtual machines for customers who need them.

Planned

Data and hosting

Hosted in the EU

Our pilot runs on Hetzner in Helsinki, Finland.

In place (pilot)

Daily backups

Two layers: the hosting provider's daily server backups, and our own daily snapshot of every workspace (the last seven kept).

In place (pilot)

Public status page

Every minute our server checks the workspace, app connections, Beni for Slack, Beni for Teams and the network edge, and app.benigo.com/status shows each as up or down with uptime over 24 hours, 7, 30 and 90 days. The checks run on the same server as the product, so they can't record an outage of the whole server; uptime there is not a service-level commitment.

In place (pilot)

Encryption in transit

Every public page and API is served over HTTPS.

In place (pilot)

Retention and deletion

Our draft policy: after you leave, your data stays available for export for 30 days, then is deleted from active systems and later from backups. Slack data is deleted within 14 business days of uninstalling, as Slack requires. These terms are a draft under legal review.

Draft

AI models

No training on your data

We don't use your data to train models. Beni uses Anthropic's Claude models through Anthropic's commercial API, and Anthropic's Commercial Terms state that it may not train models on customer content from its services.

In place (pilot)

Retention at the model provider

Anthropic states that it deletes API inputs and outputs within 30 days, with exceptions it lists for policy and legal reasons.

Provider policy

Compliance

SOC 2

On our plan, not started. We hold no certification today.

Planned

Independent penetration test

On our plan, not done yet.

Planned

GDPR, DPA and subprocessors

A data processing agreement and a subprocessor list are drafted and in legal review.

Draft