Security
Your clients' photos stay your clients'.
beform handles pictures of the rooms people live in. This page says where they run, who can reach them, how long they are kept and what beform will never do with them.
How it is built
The answers, in the order your IT asks for them.
Four questions decide whether a platform can hold a client's home: where it runs, who can reach it, what happens to the data, and how the thing is operated.
Where it runs
- Stored in Zurich, run in Frankfurt
- beform runs on managed infrastructure. The database and the file storage, which hold requests, photos, visuals and accounts, are in Zurich, Switzerland. The application and its server functions run in Frankfurt, Germany, and static files are delivered from wherever a visitor is. These locations are written into the client agreement. A company that needs another region can ask for one, as a separate setup.
- When data leaves Switzerland
- To form a visual, a photo goes to the AI models of Google and OpenAI, which process it on their own infrastructure, including in the USA. Email is sent from Ireland, and the email provider keeps its account and logs in the USA. Switzerland and the EU recognize each other's protection as adequate. For the USA, beform relies on the Swiss-US and EU-US Data Privacy Framework where the recipient is certified, and otherwise on the EU Standard Contractual Clauses.
- Encrypted in transit and at rest
- Every connection to beform, from a visitor's browser, a consultant's tablet or your own systems, runs over TLS. The database and the files are encrypted at rest by the hosting providers that hold them.
- Operated by a Swiss company
- beform is built and operated by crue GmbH in Ennetbaden, Switzerland. The client agreement is under Swiss law. Its data processing annex covers the Swiss Federal Act on Data Protection, the GDPR and, where it applies, the UK GDPR, and it is part of the agreement, so there is no separate document to sign.
Separation and access
- Every company kept apart
- All clients share one database, and every record in it belongs to exactly one client. Row level security in the database lets a signed-in user read only their own company's records, and server processes without a user session limit every query to one client. After changes to the database, a test signs in as two companies and checks that each sees only its own data.
- Roles, checked on the server
- Every person has a personal account with a role: owner, admin, sales, consultant or viewer. What a role may do is checked on the server, not only hidden in the interface. Access to the production systems is limited to the people at crue who run them.
- Two-factor sign-in
- Two-factor sign-in is available for every user, and we recommend it for everyone. Single sign-on through your own identity provider is not offered today, so a person who leaves is removed in the portal as well as in your directory.
- The beform team, only when you let it
- crue staff see your data in the portal only through a time-limited, read-only support access you grant, or while preparing a Second Look run you asked for. Every page and record they open, and every change beform makes to your account, is recorded, and your owners read it in the portal under Activity by beform.
Your clients' data
- Private storage, signed links
- Photos and visuals sit in private storage with no public address, and a file opens only through a signed link that expires. In the Showroom and the Studio, a photo is reduced and re-encoded in the browser before it is sent, which removes embedded data such as the location.
- Retention, as the contract states it
- Photos from Showroom visitors who send no request are deleted 90 days after upload, together with the visuals formed from them, unless agreed otherwise. Requests with their photos and visuals stay until you delete them or the agreement ends. A daily job carries out the deletions, and server logs at the providers are kept for up to 30 days.
- Export and deletion
- You can find, export and delete requests in the portal yourself, and an owner can export all of the account's data there. When the agreement ends, we export your content and requests in a common format if you ask within 30 days, once free of charge, and delete the data within a further 30 days, unless the law requires us to keep it. Copies of deleted data leave the database backups within seven days and the weekly file backup within 90 days at most. We confirm the deletion on request.
- No training on your data
- beform does not use your content or your clients' data to train AI models, and under the API terms of beform's accounts the AI providers do not either. They keep inputs and outputs only for a limited period, to detect abuse.
How beform is operated
- Secret keys on the server
- Secret keys are held only on the server and never reach a browser. None is written into the code.
- Signed calls, checked input
- Calls between beform's own systems are signed and accepted only within a short time window, so they cannot be replayed. Sessions and cookies are signed, input is validated, and the public Showroom is rate limited.
- Backups
- The provider backs up the database daily, and the backups roll off on its normal cycle, currently seven days. Files are also copied every week to a separate provider in the EU (Cloudflare R2), locked against deletion for 30 days. A copy of a deleted file leaves that weekly backup within 90 days at most.
- Breaches and new subprocessors
- If a personal data breach affects your data, we tell you without undue delay, where possible within 72 hours of becoming aware of it, and keep you updated. A new subprocessor is announced by email 30 days before it starts.
Deliberately not
What beform does not do.
Some of the most useful things a platform can say are about what it leaves out.
- No biometric processing. beform reads spaces, not faces, and does not identify or categorize people.
- No automated decisions about people. Nothing in beform scores, ranks or decides anything about a person.
- No third-party trackers without consent. No advertising cookies, no data sold, no pixel that fires before you agree.
- No client photos in our marketing. Examples on this website are our own, and a customer's work appears only with written permission.
What beform does not claim
beform holds no security certification today. There is no ISO 27001 certificate, no SOC 2 report and no published penetration test, and service levels apply only where an order includes them. What this page describes is what the client agreement commits crue to. If your procurement needs a certification, say so early and we will tell you honestly where we stand.
Subprocessors
Everyone who touches a project, named.
beform runs on a short list of managed services, each under data processing terms unless its line says otherwise. For your clients' data, the binding list is the one in the client agreement. For this website, it is the privacy notice.
Service
What it does
- Vercel
- Runs the applications and server functions in Frankfurt, Germany, and delivers static content worldwide.
- Supabase
- The database, the file storage and sign-in behind a client account, in Zurich, Switzerland. Also the short-lived counters behind this website's limits.
- Cloudflare
- A weekly copy of the files, stored in the EU (Cloudflare R2) and locked against deletion for 30 days. Copies of deleted files leave it within 90 days at most.
- GitHub
- Runs the weekly copy of the files on its own servers, including in the USA. The files pass through while they are copied and are not kept there.
- The Gemini models that read photos and form visuals, on Google's infrastructure, including in the USA, and Workspace for our own email, support included.
- OpenAI
- Models that read photos, suggest directions and form visuals, and the assistant in the client portal, in the USA.
- Resend
- Confirmations, request alerts, sign-in and invitation emails, the newsletter and, where used, Second Look messages. Sent from Ireland, with the account and logs in the USA.
- Stripe
- Card payment of your own invoices, where the portal offers it. Receives your billing details only, never your clients' data.
- Microsoft Clarity
- Heatmaps and session recordings of this website, only after a visitor accepts all cookies, with forms and photos masked. Never inside a customer account. Microsoft receives this data as an independent controller under its own terms, not under data processing terms.
Disclosure
Reporting a vulnerability
If you believe you have found a weakness in beform, write to us with the subject Security. Tell us what you found, where, and how to reproduce it. We confirm receipt within two working days, keep you informed while we fix it, and we will not pursue anyone who reports in good faith and does not access or change data that is not theirs.
hi@beform.aiSee beform on your own client photo.
Upload one photo in the demo and watch it form. Or book thirty minutes and we will run it on three of your real projects.