Security at Firebeam
Last updated: October 14, 2026
How your data is protected: isolation, access control, encryption, and the vendors we rely on.
Tenant isolation
Every row of workspace data is scoped to your company and protected by database-level row-level security policies, so one customer's data is never reachable from another's session — enforced in the database itself, not just in application code.
Encryption in transit
All traffic between your browser, our services and our subprocessors is encrypted with TLS. Connections from synced tools arrive through verified webhooks.
Authentication and access control
Passwords are stored as salted hashes by our authentication layer and are never visible to us. Inside a workspace, role-based permissions separate administrators from members, and members can additionally be restricted to specific projects and modules. Integration tokens are stored server-side, never exposed to the browser, and excluded from data exports.
Abuse protection
Authentication endpoints, invitations and expensive operations are rate-limited. Security-relevant headers (CSP, HSTS, frame and content-type protections) are set on every response.
Administrative access
Support access to customer workspaces (impersonation) requires superadmin rights, is time-limited, and every session is written to an audit log.
AI data handling
AI features send only the workspace content needed for the specific generation to our AI provider, log the generation for billing, and return the output to your workspace. Our AI providers are not permitted to train models on your content.
Subprocessors
Paddle (payments, merchant of record) · Scaleway (AI generation on EU servers in Paris, the default) · Google and Anthropic (AI generation outside the EU, only for workspaces that turn off EU model location) · Resend (transactional email) · Sentry (error monitoring, where enabled). Tools you connect yourself — Jira, GitHub, Linear, Slack, analytics providers — act under your own authorization and are not subprocessors.
Data lifecycle
Deleting a workspace removes its projects, synced items and module data. Long-inactive workspaces are deleted only after staged email warnings, and any login stops the process. Disconnecting an integration invalidates its tokens immediately.
Reporting a vulnerability
If you believe you have found a security issue in Firebeam, please email us and include enough detail to reproduce it. We confirm receipt quickly, keep you informed while we fix confirmed issues, and do not take action against good-faith research.
Questions about this page? support@firebeam.eu