Skip to content
Start building free

Security and infrastructure

Security and infrastructure.

We run the models, compute, and upgrades. You set the schema and see every result. SOC 2, HIPAA, and GDPR, with deployment options from cloud to fully air-gapped.

Request the security packageTrust center

Where bem runs

  1. 01CloudMulti-tenant, isolated by organization
  2. 02Private LinkTraffic stays off the public internet
  3. 03In your VPCInside your own cloud account
  4. 04On-premiseOn hardware you control
  5. 05Fully air-gappedInside your perimeter

01Infrastructure

We run the models, compute, and upgrades. You set the schema and see every result.

No model selection, GPU capacity, or deprecation cycles for you to manage.

You

  • The schema
  • Your policies
  • Review thresholds
  • Every result, inspectable

bem

  • The models
  • The compute
  • The upgrades
  • Retraining from your corrections
  • 01

    No model selection

    bem chooses and evaluates the models behind each component. You define the schema and get the same shape back.

  • 02

    No GPU capacity

    bem runs the compute and scales it. You don't size, reserve, or queue for hardware.

  • 03

    No deprecation cycles

    When a model is upgraded or retired, bem handles the change underneath the component.

02Accuracy and review

Accuracy you can measure. Results you can open.

bem carries the burden of correctness. Every field comes back with a confidence score and the reasoning behind it. You set the threshold below which a person reviews the result.

Recorded evaluation · bill of lading · overall 0.98 · no hallucinations flagged
  • bill_of_lading_number"079243"0.99

    The value '079243' is directly extracted from the 'B/L No.' field on the Bill of Lading. It is also referenced as '079243' under 'Déclaration sommaire/ Document précédent S/L'.

  • gross_weight"28.000.00 kgs"0.98

    The value '28.000.00 kgs' is directly extracted from the 'Gross weight 28.000.00 kgs' field on the Bill of Lading. This is consistent with 'Poids brut (kg) 28.000,00' and 'Poids Brut 28.000,00' in the customs declaration.

  • signature(signature block text)0.92

    The value is a direct extraction from the 'Signature' field on the Bill of Lading. While there might be some OCR artifacts or formatting issues in the extracted text (…), it faithfully reproduces the visible text in that section, which represents the signature block.

    Below the 0.95 example threshold. Sent to human review.

  • 01

    Accuracy metrics

    Precision, recall, and F1 per field, with regression testing as you change a schema or a workflow.

  • 02

    Human review

    A built-in review interface for the results below your threshold, so a person sees only what needs one.

  • 03

    Corrections

    Submit corrections and golden datasets. Every result stays inspectable back to its input.

03Training and data

Your corrections train your models. You own the weights.

Customer corrections train the models automatically, and you own the weights. Nothing trains on your data for anyone else.

  • 01

    Automatic training

    Once you opt in, every correction trains your models. Nothing trains on your data for anyone else.

  • 02

    You own the weights

    Models trained on your data are yours.

  • 03

    Zero-retention mode

    For sensitive payloads, process transiently. The source file and intermediate states are purged after the output is delivered.

  • 04

    Encryption

    TLS 1.3 in transit and AES-256 at rest, with keys rotated regularly.

04Deployment

Deploy where your data lives.

Five options, one platform. Pick the isolation your governance requires.

  • 01

    Cloud

    Multi-tenant, isolated by organization, and managed by bem.

    • US and EU regions
    • TLS 1.3 and AES-256
  • 02

    Private Link

    Connect bem to your network without traffic crossing the public internet.

    • AWS PrivateLink and Azure Private Link
    • No public IP exposure
  • 03

    In your VPC

    Run bem inside your own cloud account.

    • Data stays in your VPC
  • 04

    On-premise

    Run bem on hardware you control.

    • Data stays on your hardware
  • 05

    Fully air-gapped

    Run bem inside your perimeter, with no network connection. Data never leaves it. When you need air-gapped, bem is the default choice.

    • Kubernetes or bare metal
    • Full data sovereignty
Private Link

05Compliance

SOC 2, HIPAA, and GDPR.

Audited by third parties, and open about it. The trust center has the reports.

  • SOC 2
  • HIPAA
  • GDPR
  • SOC 2

    Type 2, audited annually

    Independent audits covering security, availability, and confidentiality.

  • HIPAA

    Security, privacy, and breach rules

    A BAA is available for enterprise customers.

  • GDPR

    EU region

    Run in the EU when your data has to stay there.

  • TEST

    Penetration testing

    Annual third-party penetration tests and continuous scanning of external assets.

  • ACCESS

    Least privilege

    Production access is need-to-know, protected by MFA, and reviewed quarterly.

  • BC/DR

    Recovery

    Daily encrypted backups, with continuity and recovery plans tested annually.

For a security review, read SOC 2 compliant document processing AI: what the report proves and what it doesn't, Which document extraction AI is deterministic and does not hallucinate? and Which document AI has human in the loop review?.

Need the security package?

Our SOC 2 report, penetration test results, and security questionnaire are available through the trust center.

Talk to usTrust center