# Security - Beanstalk Governance Studio Source: https://getbgs.com/security {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":\[{"@type":"ListItem","position":1,"name":"Home","item":"https://getbgs.com"},{"@type":"ListItem","position":2,"name":"Security","item":"https://getbgs.com/security"}\]} # Security **Beanstalk Web Solutions LLC**  |  Last reviewed: October 20, 2026 ### Overview Beanstalk Governance Studio is a desktop application that runs directly on your computer. Most of what it does - scanning sites, auditing accessibility, generating reports, and scoring AI/search readiness - happens entirely on your machine. There is no server in between processing your site content, which means there's no cloud copy of your scan data for us, or anyone else, to secure in the first place. The sections below describe what is handled locally on your device, what is handled by a small set of cloud services (account sign-in, plan status, and release hosting), and which responsibilities sit with us, with our infrastructure vendors, and with you as the user. ### Local Data Handling Site scans, audit results, generated reports, and AI & search readiness scoring are all processed and stored locally on your computer. This includes scans of live sites, staging environments, and localhost/private-network builds - nothing about the pages you scan, or the reports generated from them, is uploaded to us by default. AI & search readiness (AEO/SEO) scoring runs on a language model embedded in the app itself, fully offline. No API key is required and no page content is sent anywhere to generate these scores. **The one exception:** if you choose to connect your own Anthropic, OpenAI, or Google API key for the optional AI explanation/summary add-ons, the specific content you ask it to process (e.g. an error description) is sent to that provider using your own key. This is entirely opt-in - it never happens by default, and the app functions fully without it. ### Release Integrity Every Windows release goes through the same signing and verification process before it's published: - Signed with a verified Organization Validation (OV) code-signing certificate, so Windows can confirm the installer genuinely comes from Beanstalk Web Solutions and hasn't been tampered with. - Scanned clean by Windows Defender and an independent enterprise-grade antivirus engine before publishing. - Submitted to Microsoft Security Intelligence for malware analysis ahead of release. - Updates are delivered as signed installers with a hash-verified update manifest, so the app only installs an update that matches exactly what we published - not an unsigned or altered file. macOS builds are planned to follow the same principle - signed and notarized - once macOS support ships. ### Infrastructure & Account Data A small set of hosted services support account sign-in and plan/team management - separate from your scan data, which stays on your device. These services store only account-level information: sign-in details, plan and billing status, and team membership. They never receive or store your scan content or generated reports. The infrastructure providers behind these services maintain their own security certifications and operational controls. We rely on that as the foundation for the account layer described above, while the application logic, access controls, and how this data is used remain our responsibility. ### Billing The app collects billing contact and plan-selection information only. No payment card details are ever entered into, or stored by, Beanstalk Governance Studio or its backend services. That information is passed to our billing team, who issue an invoice with a secure payment link through QuickBooks. Actual payment processing and card data handling happen entirely within QuickBooks' own infrastructure. ### Account & Access Management Sign-in uses standard authenticated sessions, with your plan and access level checked each time you sign in. A single account supports up to 5 simultaneous sign-ins, so your team can work from anywhere under one flat-rate plan without per-seat provisioning. ### Secure Communications Traffic between the app and our account services (sign-in, plan status checks) is encrypted in transit via TLS. Because scan data is processed locally rather than sent to a server, most of what the app does involves no network transmission of your content at all. ### Data Residency Scan data, audit results, and generated reports are stored on your own device, under your organization's own control - not in a region or jurisdiction we choose on your behalf. Account data (sign-in, plan status) is hosted via the infrastructure providers described above. ### Your Responsibilities Security here is shared. Alongside what we and our infrastructure providers maintain, we ask that you: - Keep the operating system and device running Beanstalk Governance Studio reasonably up to date and patched. - Protect your sign-in credentials, and avoid sharing your account outside your team. - Only run the app on devices you trust and control - since scans and reports are generated and stored locally, the device itself is part of your security boundary, not ours. - Treat exported reports (Word, Excel, HTML) as sensitive once generated - they may contain details about your site's structure or vulnerabilities, and protecting that file after it's created is your responsibility, the same as any other document on your machine. - Promptly report any suspicious activity on your account to us. ### Responsible Disclosure If you believe you've found a security issue in Beanstalk Governance Studio or our account services, please report it to [support@getbgs.com](mailto:support@getbgs.com). We take these reports seriously and will respond as quickly as we can. ### Our Approach to Formal Certification We don't currently hold formal certifications such as SOC 2 or ISO 27001 ourselves. Our actual security footprint is intentionally small: the data that matters most - your scans, audits, and reports - is processed and stored entirely on your own device, not on servers we operate, which limits what would even be in scope for a certification like SOC 2 in the first place. The account and billing services we do rely on run on established, reputable infrastructure providers with their own strong operational practices around patching, backups, and uptime. As the product and our customer base grow, formal certification is something we expect to pursue - and our architecture's small server-side footprint means we'd be starting from a reasonably strong position when we do.