# For the security and architecture review.

The 6 areas from the Enterprise Trust block, in depth: what runs where, who can do what, and exactly what is still in progress. Honest status throughout, no polished facade.

## Data residency & deployment

beacon.build runs on Google Cloud in Zürich (europe-west6), via our hosting provider Northflank, so your data stays Swiss-hosted by default. If your organization needs the platform inside its own perimeter, on-prem deployment is available on request, agreed individually rather than self-serve.

## Model access & BYOK

Bring your own model and your own keys. Every model call runs on your own provider contract, never through us, and never against a bundled token quota we resell. When an agent calls a hosted model, that prompt goes to the provider you picked: a visible, deliberate choice, never a hidden default.

## Access control & accountability

Access is role-based, and every agent acts under its own identity, not a shared service account: who did what, on which Spec, with which model, is traceable and live in the product. Single sign-on is on request: not built yet, set up as soon as your engagement needs it, and the platform is designed so adding it is straightforward.

## Architecture & isolation

A single-instance or on-prem deployment gets its own isolated environment: no shared tenancy, no shared token quota, no model lock-in. Two decisive human control points frame agent work (after the Spec, and before merge), with a human integrator as the sole merger, so nothing ships without an explicit go.

## Compliance status

Our hosting provider, Northflank, holds SOC 2 Type 2 (details on request via their trust center); its infrastructure runs on Google Cloud in Zürich. A data processing agreement with Northflank is in progress. We answer security questionnaires and vendor assessments on request today; beacon. would pursue a certification such as ISO 27001 if a customer engagement required it, not before. Google Cloud publishes its own infrastructure-level certifications (see the source link below); those are Google’s, never a beacon. or Northflank claim.

## Procurement & licensing

Seat pricing starts from 10 users. Single-instance deployments and org-wide site licenses are negotiated individually for your setup, not sold off a list price, so the contract reflects your actual deployment and volume.

## The components, as they actually exist today.

No invented components: this mirrors the same platform capabilities described on /platform, laid out as the pieces a reviewer needs to see together.

### Deployment

Swiss-hosted (Google Cloud, Zürich, via Northflank) by default, or on-prem inside your own perimeter, on request.

### Model access

BYOK. Calls run on your own provider contract; no bundled token quota we resell.

### Identity & access

Role-based access; agents act under their own identity, not a shared account.

### Human control points

After the Spec, and before merge: a human integrator is the sole merger, agents never ship unreviewed.

### Guardrails & quality gates

Constitution and Engineering Practices, Spec Test Driven Development, and a Definition of Done enforced on every change.

### Audit trail

Every unit of work traceable: who did what, on which Spec, with which model.

## The honest gap list.

What a thorough evaluator asks about next, stated plainly rather than glossed over.

Single sign-on: on request, set up as soon as your engagement needs it.

A signed data processing agreement with our hosting provider: in progress, not yet signed.

A formal certification such as ISO 27001: not pursued today. We answer security questionnaires and vendor assessments on request, and would pursue a certification if a customer engagement required it.