Beam Prism: Security and Data Handling
Last updated: 4 November 2026
This document describes how Beam Prism accesses, stores, protects and deletes customer data.
1. Scope
This document applies to Beam Prism, including its web, desktop and mobile applications ("Prism"). Beam's agent platform is documented separately at beam.ai/legal/data-security.
2. Access to Microsoft 365 and Google accounts
Prism uses delegated permissions only and acts as the signed-in user. It does not request application or organisation-wide permissions. No admin role is needed; users connect their own account.
Prism can access the user's own mailbox and calendar. As that user, it can read, draft, move and send mail, and manage events. Optionally, in the desktop app, it can list Microsoft Teams channels and post a message the user has approved.
Prism has no access to Teams meetings, recordings or transcripts, and no access to SharePoint or OneDrive.
Microsoft 365 administrators can revoke Prism's access in Microsoft Entra at any time. They can also limit the app to assigned users.
3. Hosting and data location
| Component | Location |
|---|---|
| Application servers | Amsterdam, Netherlands |
| Database and file storage | Ireland |
| Conversations with the assistant | Prism's servers in Amsterdam |
One shared service is hosted in the EU. External AI model providers may process requests outside the EU. Dedicated or in-country hosting is not currently offered.
4. Sub-processors
The following services process Prism data on Beam's behalf.
| Service | Region |
|---|---|
| Application hosting | Amsterdam, Netherlands |
| Database, file storage and sign-in | Ireland |
| Web application: carries requests and live chat between the browser and Prism's servers, without storing their content | United States |
| AI model routing (providers include Anthropic, OpenAI, Google and DeepSeek) | Chosen per request |
| Search indexing and some AI requests | United States |
| Backup AI models | Chosen per request |
| WhatsApp messaging | United States |
| Live meeting transcription (desktop app) | United States |
| Connections to other apps the user chooses to add | United States |
| AI quality records, personal identifiers removed | Ireland |
| Error reports, secrets removed | Germany |
| Product usage events, no message content | EU (web); server-side events to be confirmed |
| Account emails | United States |
The named list of sub-processors is set out in Annex 3 of Prism's data processing agreement at prism.beam.ai/legal/data-processing. It is updated when a sub-processor is added or replaced.
5. AI model providers
Prism uses several AI model providers, accessed through a model-routing service. Users can choose the model used for chat and daily briefs. Email analysis uses Prism's standard models.
6. Data stored by Prism
| Data | What Prism stores |
|---|---|
| Emails | No full copies. Prism stores the subject, the sender, its summary and suggested actions, short quotes when it flags a suspicious email, and drafts the user approved. |
| Attachments | Not stored. Text from an attachment may remain in the user's conversation with the assistant. |
| Meeting recordings | Only recordings made in the iPhone app. |
| Transcripts | Stored, from Prism's apps or imported from the user's note-taking tools. |
| WhatsApp messages | Full text. |
| Conversations with the assistant | Stored. |
7. Retention and deletion
| Data | Retention |
|---|---|
| Chat-channel messages (WhatsApp, Slack, Telegram and iMessage) | 180 days, then deleted automatically. |
| Summaries | Until the account is deleted. |
| Transcripts | Until the user deletes them or the account is deleted. |
| Conversations with the assistant | Until the account is deleted. |
After a contract ends, customer data is deleted within 90 days, as set out in Prism's data processing agreement.
When a user disconnects an account, Prism stops using it. The stored connection remains until the account is deleted. Users can remove Prism's consent in their Microsoft or Google account settings at any time.
8. Security measures
Data in transit is protected by HTTPS (TLS). Database and file storage are encrypted at rest with AES-256. Server disks use the hosting provider's default encryption at rest.
Each user's database records are kept apart by row-level security. Connection credentials are stored only on Prism's servers and cannot be read by users or client applications.
9. Certifications and contractual terms
Beam holds a SOC 2 Type II report for its agent platform, available under NDA. It does not cover Prism.
Prism's data processing agreement: prism.beam.ai/legal/data-processing. Privacy policy: prism.beam.ai/legal/privacy-policy.