Beamfar security: what is built, and what is not.
This page lists security controls that exist in the code and have tests. It makes no promise beyond them. Beamfar is new: it has not been through an independent audit and holds no certification.
- No third-party scripts
- No cookies on this site
- No certification claimed
Controls in the code, each with a test
- Second factorTOTPBuilt
- PasswordsArgon2idBuilt
- Tenantsrow-level securityBuilt
- SecretsAES-256-GCMBuilt
- Checks outSSRF guardBuilt
- Auditnone yetNot done
Controls that exist in the code
Each line has an automated test.
- Second factor
- Authenticator-app codes (TOTP), each code accepted once, plus ten recovery codes shown once. Owners and admins must use it. Changing sensitive settings asks for a recent sign-in.
- Passwords
- At least 15 characters, checked against a list of breached passwords without sending the password (only the first five characters of its hash leave the server). Stored hashed with Argon2id. If the breach service cannot be reached, the password is accepted and checked again at the next sign-in.
- Sessions
- A random token in a cookie that scripts cannot read and that is sent only over https. Sessions end after inactivity and after a fixed time, and when an account is deleted.
- Tenant isolation
- Each organisation’s data is separated by row-level security in the database, in addition to checks in the application. A test fails if a table is added without a policy.
- Roles
- Four roles (owner, admin, member, viewer) from one permission table. Every route names the permission it needs, and a test checks that none is missing.
- Sealed secrets
- Alert destinations and webhook signing secrets are stored encrypted (AES-256-GCM) and the secret is shown once. Keys can be rotated.
- Signed webhooks
- Webhook alerts are signed, so the receiver can verify that they came from Beamfar.
- SSRF guard
- Every outbound check, and the free site check, refuses loopback, private, link-local and cloud-metadata addresses, numeric host forms and local names. Each name is resolved once, every address is classified, and the connection goes only to the address that passed. Every redirect is checked again.
- Browser protections
- A content security policy that allows scripts only from this site, a CSRF header on every change, no cross-origin access, and no third-party scripts.
- Rate limits
- Sign-in, sign-up, password reset, exports and the free site check are rate limited across all app processes.
- Your data
- Owners can export an organisation’s data and delete the organisation or their account. Exports never contain password hashes or secrets.
What this page does not claim
What is not done and what is not built, said as plainly as what is.
- Not done
- No independent security audit and no penetration test. No compliance certification of any kind. The legal pages are version 1, in force from 2 November 2026.
- Not built
- Single sign-on. Hosting: nothing is deployed for customers yet.
Found a problem? Tell us through the contact page; the imprint has the operator’s details.
Questions
Is there two-factor sign-in?
Yes. Authenticator-app codes, with recovery codes. Owners and admins must use it.
Can customers read each other’s data?
No. Organisations are separated by row-level security in the database as well as by checks in the application, and tests cover it.
Is it certified or audited?
No. It is new, with no independent audit and no certification.
Can I export or delete my data?
Yes. Owners can export an organisation’s data and delete the organisation; an account can be deleted too.
See it before you trust it.
Start the trial with test data of your own choosing.
No card for the trial.