Security and privacy
Bee Flow works with your mail, documents and customer data. Here is what happens to them, what we do not claim, and where your IT team finds the technical details.
Technical detailsYour data
In your own Bee Flow environment: on your own servers, or hosted for you. Self-hosted, Bee Flow does not call home and checks its licence key offline.
Only the AI model you choose: one of eight hosted providers, or a model on your own hardware. Without a connected provider, no text goes to an outside model.
With the guard service installed and switched on, Privacy Shield detects 21 kinds of personal data and blocks the message, or from Pro replaces it with placeholders. Detection uses machine learning and is not flawless.
Approval steps hold anything that goes to a customer until someone agrees. Who decided, when and on what is logged.
Runs, changes and calls to connected apps are logged without their content, so you can see what happened and where data went.
Some connections only read, such as AFAS, NMBRS and vPlan. Mail, calendars and files can also write or send; that is switched on only where it is needed.
Product status
So you know what you are relying on.
| Status | Good to know | |
|---|---|---|
| Automations and approval steps | Generally available | Approval steps from Pro |
| Privacy Shield | Generally available | Needs the guard service installed and switched on |
| Content encryption | Generally available | Off by default; zero-knowledge covers the messages of private chats (Enterprise) |
| Compliance Center | Generally available | 84 readiness checks in 10 frameworks; readiness, not a certificate (Enterprise) |
| Support inbox, MCP library, AI integration builder, voice chat | Beta | Usable, still changing |
| ISO 27001 or SOC 2 certificate for Bee Flow | Not held | We do not claim certification |
Honest about limits
Bee Flow holds no ISO 27001 or SOC 2 certificate. The Compliance Center helps you prepare your own environment; it is not a certificate and not legal advice.
No software makes you GDPR-compliant on its own. Bee Flow gives you controls and logs; how you use them decides whether you comply.
Where and how we host Bee Flow for you, and which subprocessors are involved, goes into the data processing agreement. Ask us for it.
Bee Flow is source-available under the Sustainable Use License (fair-code): you may use, change and self-host it for your own organisation, and your IT team can check how data is handled. The Nextcloud connector is AGPL-3.0.
See the technical detailsFAQ
Data that is not zero-knowledge encrypted can be read by whoever runs the server. Self-hosted, that is you. Hosted for you, access is bound by the data processing agreement.
With Privacy Shield switched on, chat messages are blocked by default instead of being sent unchecked. Other parts, such as tool results and large attachments, have their own settings; the technical page explains them.
Encrypted at rest with a key the server operator manages. That protects them against a stolen database, not against the operator of the server.
E-mail info@beeflow.nl with security in the subject, and keep exploit details out of the first message. We reply and agree how to share the rest.
Send them our way. We answer security questionnaires and show where each answer comes from.
Contact us