BeSavvy is deeply committed to the security of data within our platform. You can trust us to keep your account information safe and protected.
Data Encryption & Protection
●Encryption in transit and at rest. All data is encrypted in transit using TLS 1.2+ and at rest using AES-256 by our hosting provider.
●Password protection. Passwords are stored only as salted bcrypt hashes, and password-reset links are stored as one-way hashes.
Secure Authentication and Access Control
●Single Sign-On (SSO) Support. BeSavvy supports secure SSO authentication via Google and Microsoft Entra (Azure), reducing the risk of credential-based attacks and ensuring seamless access management.
●Multi-Factor Authentication (MFA). MFA is enforced on every BeSavvy account with access to our hosting, database and source code.
●Role-Based Access Control (RBAC). Access is limited by role within each organisation (Admin, Manager, Viewer, Member) and within each course (Author, Mentor), with Edit or Comment permissions.
◐Session security. Sessions use signed tokens in secure, HTTP-only cookies. We are shortening session lifetimes and adding further protection to session handling.
Privacy Protection & Compliance
●Data Minimization Approach. We collect and process only the data necessary for platform functionality, ensuring users' privacy is respected.
●GDPR & UK GDPR Compliance. Our data protection policies align with GDPR principles, including user rights to access, correct and delete their data.
●Regular Compliance Reviews. We run internal reviews and gap analyses against UK GDPR and the SOC 2 criteria.
●Data Processing Agreement (DPA). A DPA is available for all enterprise clients. Contact [email protected] to request a copy.
AI & Third-Party Data Handling
●No AI Training on Client Data. Your data is never used to train or fine-tune AI models, by BeSavvy or by any of our AI providers. Client data is used solely to deliver the agreed service.
●AI providers. We use OpenAI and Anthropic (Claude) through their business APIs, whose terms prohibit using submitted data for model training. Providers may keep requests for up to 30 days for abuse monitoring only.
◐Zero data retention. We have applied for zero-data-retention terms with OpenAI and Anthropic, so that requests are not kept at all after processing.
●Client source material. Documents you upload to build playbooks are processed in memory and are not stored as files. We keep only the extracted text and the playbooks built from it, and delete them at the end of an engagement on request.
●Voice role plays. Speech in voice role plays is processed by Deepgram and ElevenLabs. Transcripts are kept for feedback and analytics, and audio recordings are stored in the EU.
◐Audio recording control. We are adding a per-organisation setting to switch off audio recording. Role plays still run and keep their transcripts; only audio-based communication analysis is lost.
●No Access to Client Internal Systems. BeSavvy does not integrate with your CRM, internal databases, or any systems holding employee or customer personal information.
Sub-processors
These providers process personal data on our behalf. We notify DPA clients at least 14 days before adding or replacing one.
●Heroku (Salesforce) on AWS. Application hosting (USA) and database (EU, Ireland).
●OpenAI. Answer evaluation, feedback and content generation. USA.
●Anthropic. Answer evaluation, feedback and content generation. USA.
●Deepgram. Speech recognition and voices in voice role plays. USA.
●ElevenLabs. Voices in voice role plays. USA.
●Bunny.net. Storage of voice role-play recordings. EU.
●Cloudinary. Image storage, including profile photos. USA.
●Postmark. Transactional email. USA.
●Crisp. Live chat and customer support. France.
●Sentry. Application error monitoring. EU (Germany).
●Google. Sign-in (OAuth) and website analytics. USA / EU.
●Microsoft. Sign-in (Entra ID). USA / EU.
Security Monitoring & Incident Response
●Signed Data Breach Response Plan. BeSavvy has officially approved and implemented a Data Breach Response Plan, outlining clear procedures for incident detection, response, and regulatory reporting — including ICO notification within 72 hours where required under UK GDPR.
●Code Reviews and Patching. Changes are reviewed before release, and dependencies are updated promptly when security issues are disclosed.
●Error and Uptime Monitoring. Application errors and service health are monitored continuously through Sentry and Heroku.
Data Backup and Recovery
●Automated, Encrypted Backups. Our database is backed up automatically by our hosting provider, and backups are encrypted with AES-256.
●Disaster Recovery Plan (DRP). A documented response strategy ensures quick data restoration and business continuity in case of incidents.
User Control & Transparency
●Data deletion on request. Client admins can ask us to delete learner or organisation data. We delete it from live systems within 30 days and from backups within 90 days, as set out in our DPA.
◐Self-service data controls (Upcoming). We are building tools for admins and learners to export and delete their data themselves.
●Transparent Privacy & Terms. Our Privacy Policy and Terms of Service clearly outline data collection, usage, and security practices.
Certification and Insurance
●UK Cyber Essentials Certified. BeSavvy holds UK Cyber Essentials certification for the whole organisation, independently assessed against the government-backed standard and valid until February 2027. Contact us for the certificate.
●Cyber and Data Insurance. BeSavvy holds £1,000,000 cyber and data insurance with Hiscox.
◐SOC 2. We are working towards a SOC 2 Type I report, targeted for the end of Q1 2027, followed by SOC 2 Type II after the standard observation period.
◐ISO 27001 Roadmap. Our security measures follow ISO 27001 and NIST CSF practices, and ISO 27001 certification is on our roadmap.
Commitment to Ongoing Improvement
●Adaptive Security Strategies. BeSavvy evolves its security measures in response to emerging cyber threats and industry advancements.
●Continuous Security Enhancements. We implement improvements based on the latest research, best practices, and regulatory changes.