Built to pass your security review.
BentoCS stores some of the most sensitive data in your company — your customer list, ARR, and renewal risk. We treat it accordingly, with defense-in-depth security and strict multi-tenant isolation enforced at the database.
Defense in depth.
Every layer — from the Postgres row to the engineer’s laptop — is hardened, audited, and documented.
Row-level isolation, enforced by Postgres.
Every tenant table carries an organization_id and a Row Level Security policy keyed to the authenticated session. Cross-tenant reads are physically impossible from the application layer — not just filtered, blocked at the database.
Encrypted everywhere.
TLS 1.3 in transit, AES-256 at rest. Per-tenant encryption keys rotated annually.
Every change, attributed.
Immutable audit log for every data mutation — who, what, when, where from. Exportable to S3 on Enterprise.
SSO, SCIM, and RBAC.
Google OAuth on every plan. SAML SSO via Okta, Azure AD, Jumpcloud and Auth0 on Enterprise — with SCIM provisioning and JIT user creation.
15-min RPO, 1-hour RTO.
Continuous WAL backups with point-in-time recovery to any second in the last 30 days. Quarterly restore drills, logged in our control evidence pack.
Your data never trains a model.
AI features (CSV mapping, QBR drafts, health summaries) use Claude via a zero-retention endpoint. No tenant data is logged, no models are fine-tuned on your customer records.
Annual third-party tests.
Cure53 runs a full-stack penetration test every 12 months. Report available under NDA.
Coordinated disclosure.
Report vulnerabilities to security@bentocs.com. PGP key on file. Bounty program in private beta.
Minimal, documented.
Six subprocessors. Full list with DPAs is public. Email notice 30 days before adding a new one.
Keep your data where it belongs.
Choose your workspace region at setup. Your customer data, AI summaries, and backups never leave it. EU customers can pin to Frankfurt; regulated US customers to us-east-1.
All systems operational.
Who we share data with — and why.
Six subprocessors, all with signed DPAs. We notify every customer by email 30 days before adding a new one.
For the security team.
Pass your security review in a single call.
Our team has been on both sides of the security questionnaire. Bring yours — we’ll answer it live.