Security & data handling
Your data stays behind your organization boundary.
- RLS policies
- 233
- Protected tables
- 84
The controls
Six things that are true by construction.
Isolation enforced by the database is the one that matters. Anything enforced in an interface is one forgotten filter away from being wrong.
Employment sits with Beepa
The people placed on your team are Beepa employees on Beepa's payroll, not contractors you have to onboard yourself. Employment, salary and statutory obligations stay on our side of the line, so accountability for conduct does not get split across two organisations.
Access is scoped per organization
Every client organisation is isolated at the database, not by a filter in the interface. 233 row-level security policies across 84 tables mean a request for one client's records is rejected by the database itself if it belongs to another.
Access is permission-checked
Access follows the job, not seniority. A named permission set decides whether a person can approve leave, read payroll, or see a client's tickets — so a placed specialist sees the work they were hired to do and nothing beyond it.
Records are append-only where it counts
Time and attendance events are written to an immutable log rather than edited in place. A correction is a new, attributable event, so the record of who was working when cannot be quietly rewritten.
Confidentiality before access
Terms of confidentiality are signed before a placed person reaches client systems or data. It is part of the employment agreement, which is one of the reasons the employment stays with Beepa in the first place.
We do not resell or mine your data
Client data is used to deliver the engagement it was given for. It is not sold, not used to train anything, and not pooled with another client's records. Deletion follows the terms on request.
What we do not claim
The short list is part of the answer.
A security page that only lists strengths reads like a brochure. If your review needs a certificate we do not hold, you should hear it from us before you find it.
Ask us directly- We are not ISO 27001 certified, and we do not display a badge we have not earned.
- We do not publish a SOC 2 report. When a prospect's security review needs one, we say so in writing rather than pointing at this page.
- We do not claim zero breaches, because we will not make a claim we cannot evidence.
Read the terms behind these commitments.
The privacy notice covers what we collect and why. The terms cover confidentiality, data return and deletion.
Tell us the role.We staff it.
Share the BPO roles you need. Beepa searches, places, and pays so you keep the work.