ChatBeacon runs on Microsoft Azure. The certifications and attestations covering that infrastructure — SOC 2 Type II, ISO/IEC 27001, PCI DSS, FedRAMP and more — are held and maintained by Microsoft for the Azure services we host on. On top of that foundation, ChatBeacon adds encryption in transit, enterprise identity integration, role-based access, audit logging, configurable retention, and a choice of cloud, dedicated private server, or on-premises deployment.
Cloud, dedicated private servers, and customer-selected Azure regions.
Held by Microsoft for the in-scope Azure services ChatBeacon runs on, alongside ISO 27001 and PCI DSS.
Technical safeguards in place; HIPAA is not a software certification. Deployments are reviewed before PHI is enabled.
AI runs under your OpenAI account and key. No shared pool, no model training on your conversations.
ChatBeacon Cloud and ChatBeacon dedicated private servers are hosted on Microsoft Azure. The audits and certifications covering that infrastructure are held by Microsoft and cover the Azure services and regions in scope for your deployment. We name the certifying party on purpose — a security reviewer needs to know which controls were examined by whom.
Microsoft publishes its current audit reports and certificates through the Service Trust Portal. ChatBeacon does not hold a separate SOC 2 report; for reviews that require application-level detail, we provide a security overview, architecture and data-flow documentation, and questionnaire support.
Microsoft Azure compliance offerings →Physical security, hardware lifecycle, network fabric, hypervisor, and platform services are operated by Microsoft under the certifications above. Physical access to datacenters is Microsoft-controlled and audited.
Enterprise customers can run ChatBeacon on dedicated Azure infrastructure rather than shared cloud tenancy — isolated application and database resources, deployment-specific configuration, and an architecture review before go-live.
Deployments are provisioned in the Azure region agreed with your team, so conversation data is processed and stored in that geography. Region selection is confirmed as part of onboarding.
Azure platform network controls, TLS-terminated public endpoints, segmented application and database tiers, and administrative access restricted to authorized ChatBeacon operations personnel.
ChatBeacon installs on customer-controlled Windows Server, IIS, and Microsoft SQL Server. The customer owns the perimeter, the database, backups, and the patching schedule. No separate ChatBeacon-hosted conversation database is required.
Microsoft secures the cloud. ChatBeacon secures the application and its operations. You control users, configuration, retention settings, and which integrations are enabled. We document that boundary per deployment.
Visitor widget, operator console, admin portal, and API traffic are carried over TLS-protected connections. The enforced minimum protocol version and cipher configuration for your deployment can be confirmed during security review.
Azure-hosted deployments rely on Azure platform encryption for database and storage services, with Microsoft-managed keys by default. On-premises deployments use the customer's own SQL Server and disk encryption and key management.
Conversation and transcript retention is configurable, so you can hold records for the period your policy requires and no longer. On-premises customers additionally control database, archival, and backup retention.
Transcripts and account data can be exported and deleted to support data-subject requests and records-management obligations under GDPR, UK GDPR, and CCPA/CPRA.
Workflow and form configuration can limit what visitors are asked to provide, reducing unnecessary capture of sensitive information in the transcript. Payment card data should never be collected in chat.
Your conversation data is yours. ChatBeacon processes it to deliver the service, does not sell it, and does not use it to train AI models.
Microsoft and Google sign-in are supported for the applicable ChatBeacon applications, with Microsoft Entra ID enterprise SSO available for eligible licensed configurations. Availability depends on application, deployment, and licensing.
When ChatBeacon is connected to your identity provider, your existing MFA, device, and conditional-access policies govern agent and administrator sign-in — no parallel policy set to maintain.
Agent, supervisor, and administrator capabilities are assigned by role, so transcript access, configuration, and reporting stay limited to the people whose job requires them.
Administrative and operational activity is logged to support traceability, supervisor review, and security investigation. Log scope and export options are covered in the security overview.
Co-browse and screen-share sessions are visitor-initiated or visitor-approved, scoped to the session, and can be configured to mask designated page fields from the agent's view.
Access to production environments is limited to authorized operations and support staff, granted for a business reason, and removed when it is no longer needed.
Changes go through peer review and testing before release. Development and production environments are separated, and production data is not used for development.
Platform and dependency updates are applied on an ongoing basis for ChatBeacon-managed environments. On-premises customers receive official update packages and control their own maintenance windows.
Reported and detected vulnerabilities are triaged by severity and remediated through the normal release process, with out-of-band fixes for high-severity issues.
ChatBeacon-managed environments are monitored for availability and error conditions, with alerting to the operations team.
If you believe you have found a security issue, send us enough detail to reproduce it. Please do not access, modify, or retain customer data while researching.
Security events are investigated, contained, and remediated, and affected customers are notified in line with contractual and legal obligations. Escalation contacts are established during onboarding.
This is the question every security reviewer asks about AI chat, so here is the direct answer: ChatBeacon AI uses the OpenAI account and API key that you own. Usage, billing, provider-level data settings, and knowledge content stay under your control, and nothing is pooled through a shared ChatBeacon account.
OpenAI does not use API inputs and outputs to train its models by default unless your organization opts in. ChatBeacon does not train models on customer data either.
AI answers are grounded in the sources you assign — approved domains and websites, and vector-store content in your own provider account — and knowledge can be scoped per workflow.
System instructions, permitted topics, moderation behavior, and escalation conditions are configured per workflow to reduce off-policy and unsupported answers.
When a conversation exceeds the AI's configured boundaries, it escalates to a live agent with context attached — so sensitive or high-risk cases reach a person.
When AI is enabled, the message content required to generate a response is sent to the AI provider over your connection. Disable AI and no conversation content leaves the deployment for that purpose.
If an AI workflow may handle PHI, your provider account needs the appropriate BAA and HIPAA-eligible API functionality. We review those workflows with you before PHI is enabled.
HIPAA has no certification program for software — any vendor claiming to be “HIPAA certified” is describing something that does not exist. Compliance belongs to the covered entity and depends on architecture, configuration, contracts, and policy. What a platform can do is provide the safeguards and deployment options that make a compliant configuration possible. That is what HIPAA-ready means here.
Discuss a healthcare deployment →HIPAA-ready deployments, PHI workflow review, BAA requirements, and private or on-premises hosting for patient-facing chat.
Audit logging, retention control, enterprise identity, and dedicated infrastructure for banks, credit unions, and insurers under examiner scrutiny.
Azure regions with government-focused authorizations, on-premises deployment, and documented data flows for agency review.
Student-record sensitivity, retention limits, and access separation across admissions, IT help desk, and student services.
Co-browse with field masking, configurable data capture, and guidance to keep cardholder data out of the transcript.
Regional Azure hosting, a Data Processing Addendum, and documented processing locations for GDPR and UK GDPR programs.
ChatBeacon-managed environments use Azure's redundant infrastructure for compute, storage, and networking within the selected region.
Managed deployments are backed up on a defined schedule with restore procedures documented for your architecture. On-premises customers own backup design and testing.
Recovery objectives and continuity detail are provided during solution and security review, based on the deployment model you select rather than a generic number.
Support and escalation paths, including severity definitions and response expectations, are set out in your service agreement.
Tell us the scope of your assessment and we will send the material that answers it. Detailed architecture and customer-specific documents are provided under NDA.
Bring your questionnaire, your architecture requirements, and your compliance scope. We will walk your security, privacy, and procurement teams through the deployment options and the controls that apply to each.
ChatBeacon Cloud and ChatBeacon dedicated private servers run on Microsoft Azure. The SOC 2 Type II attestation covering that hosting environment is held by Microsoft for Azure services. ChatBeacon operates its application on top of those certified services and can provide a security overview, architecture documentation, and questionnaire support for vendor reviews.
Because ChatBeacon is hosted on Microsoft Azure, the underlying infrastructure falls under Microsoft's certifications and attestations, including SOC 1, SOC 2 Type II and SOC 3, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 27701, PCI DSS, HITRUST and FedRAMP for in-scope Azure services and regions.
ChatBeacon is HIPAA-ready, not HIPAA certified — HIPAA has no certification program for software. ChatBeacon provides the technical safeguards a covered entity needs, including encryption, access control, audit logging, retention control, and private or on-premises deployment, and Azure supports HIPAA-eligible services under a Microsoft BAA. Configuration, contracts including any required BAA, and organizational policy determine compliance for a given deployment.
In the Microsoft Azure region selected for your deployment. ChatBeacon Cloud, dedicated private servers, and on-premises installs all keep conversation data in the environment chosen for that deployment; on-premises installs store data in the customer's own Microsoft SQL Server.
Yes. Traffic between browsers, agents, and ChatBeacon services is protected with TLS, and data at rest in Azure-hosted deployments is encrypted using Azure platform encryption for storage and database services. On-premises deployments use the customer's own encryption and key management.
No. Customers using ChatBeacon AI connect their own OpenAI account and API key, and OpenAI does not use API data to train its models by default. ChatBeacon does not pool AI usage through a shared account and does not train models on customer conversations.
Yes. ChatBeacon can be deployed on customer-controlled Windows Server, IIS, and Microsoft SQL Server infrastructure, or as a dedicated private server hosted on Azure. On-premises deployments keep conversation records inside the customer network unless an external service such as AI is enabled.
ChatBeacon supports Microsoft and Google sign-in for supported applications, with Microsoft Entra ID enterprise SSO available for eligible licensed configurations. MFA and conditional access are applied through the connected identity provider.
Yes. ChatBeacon provides configurable retention, data export, deletion, and access controls, offers a Data Processing Addendum, and lets customers choose the Azure region their data is processed in. Regulatory obligations depend on the customer's own processing, contracts, and policies.
A security overview, architecture and data-flow documentation, deployment and shared-responsibility detail, a Data Processing Addendum, subprocessor information, AI data-handling documentation, and completion support for security questionnaires. Some material is provided under NDA.
