Security & Data Handling
What happens to your documents
Documents reach Beacon in two ways: emails copied to your organization's Beacon address, which are received by Postmark, or files dropped on the Beacon dashboard. Beacon files each document in your organization's own connected storage (Google Drive, OneDrive or SharePoint), in the folder your administrator chooses.
Beacon sends each document to Atlas, 11Foundry's document extraction service. Atlas reads the text of the document; scanned pages and photos are read with Google Cloud Document AI. Atlas then uses Anthropic's Claude API to identify the supply chain information in the text: companies, products, species, places of harvest, shipments and plots. When an email links to files instead of attaching them, Atlas reads the files behind the links as well, and Beacon files a copy of each in your storage.
Beacon then checks the results. Rule-based checks (tariff codes, certificates, composite-wood requirements) run on Beacon's servers. Cross-document checks use Anthropic's Claude API, which receives the email text, the data Atlas extracted and the documents' names, not the original files.
AI training
Your documents, results and feedback are not used to train or improve AI models, by 11Foundry or by Anthropic. Both Beacon and Atlas use Anthropic's commercial API, whose terms exclude customer content from model training.
The feedback your team gives Beacon (for example, marking a finding as a false positive and saying why) is used in your organization's own future checks only. When three or more organizations mark the same kind of finding as a false positive, Beacon drafts a general rule from the pattern; 11Foundry reviews it before it is used, and it describes the pattern, not any organization's documents.
What Beacon keeps, and for how long
| What | How long |
|---|---|
| Emails: sender, recipients, subject, headers and body text | While your account is open, unless an administrator deletes the capture. |
| Document files | Filed in your own storage, where they stay under your control. Beacon keeps each file's name, type, size, a SHA-256 fingerprint and its location in your storage. |
| Document files while they are processed | Held by Beacon (an emailed attachment in its database, an uploaded file on its own disk) until the file is filed in your storage, then deleted. Without connected storage, an uploaded file is deleted when processing ends (7 days later if processing failed, so it can be retried); an emailed attachment is kept until storage is connected and it is filed there. |
| Extracted data, findings, transactions, notes and resolutions | While your account is open, unless an administrator deletes the capture or transaction. |
| Your settings, reference data, supplier registry, organization policies and feedback | While your account is open. |
| Users and sign-in records | Accounts while your account is open. Failed sign-in attempts: 1 day. |
| Mail Beacon could not accept (sent to an unknown address or from a sender your organization does not allow): sender, recipients, subject and sending IP address | 30 days, for troubleshooting. |
| Database backups | Taken nightly; each is kept 7 days, on Beacon's server, in 11Foundry's Google Drive and in 11Foundry's Microsoft Azure storage in the United States. |
| Application logs and error reports | Kept by our hosting and error-monitoring providers under their retention settings. Neither holds document content. |
Atlas keeps its own records of each extraction, for the periods listed on its Security & Data Handling page; the files it reads are deleted once processing ends.
Deleting data and closing an account
An administrator can delete a capture. That deletes its email, attachment records, extracted data and findings, and the files Beacon filed in your storage for it (a file another capture also uses is kept). An administrator can also delete a transaction.
When a subscription ends, the account becomes read-only and its data is kept. To have an account and its data deleted, write to info@11foundry.com. Deletion removes every record Beacon holds for the organization from its database at once, and you receive a written confirmation listing what was deleted. Files still held for processing are deleted within two days, and the data leaves our backups within 7 days.
Where Beacon set up your Atlas account, Beacon tells Atlas the account is closed: Atlas disables it at once and deletes it, with its data, after its 90-day grace period. If your organization connected an Atlas account of its own, that account is not affected.
Deletion does not remove the files in your own storage: they belong to your organization. Records held by our billing provider for accounting are kept.
Who can see your data
Each organization's data is available only to its own users. Members can view captures, transactions and findings; administrators also manage settings and users. 11Foundry administrators can access stored data to run the service, provide support and troubleshoot.
Data goes to other 11Foundry services only as the work requires: Atlas, which reads every document; Forest Risk, which receives plot locations, species and countries to score forest risk, and checks the plot areas against public and commercial geospatial datasets; the TRACES filing service, when a due diligence statement is prepared; and Command Center, when your organization connects it.
Service providers
| Provider | What for | What it receives |
|---|---|---|
| Railway | Hosting, database, file processing and backups | Everything Beacon stores |
| Microsoft Azure | An off-site copy of the nightly database backup, kept 7 days | Everything in Beacon's database |
| Anthropic | Checking documents and sorting them into transactions (Beacon); reading documents (Atlas) | Email text, document text and names, extracted data and findings |
| Google Cloud Document AI | Reading scanned pages and photos, via Atlas | Page images |
| Google Workspace | Outbound email from mailer@11foundry.com; a copy of the nightly backup in 11Foundry's Google Drive | Email addresses and the message (finding notifications, invitations, password resets, support requests); the backup |
| Postmark | Receiving email sent to your Beacon address | The whole email, attachments included |
| Your Google Drive, or Microsoft OneDrive or SharePoint | Storing your documents, in the storage your organization connects | Your documents and Beacon's index of them |
| Stripe | Subscription billing | Organization name, billing email address and usage counts; no documents |
| Sentry | Error monitoring | Technical error details, which can name a file or an email subject; no document content or request bodies |
In your browser, Beacon pages load fonts from Google Fonts.
Security measures
All traffic is encrypted with TLS, and browsers are told to use HTTPS only. Passwords are stored with bcrypt. Atlas keys and storage credentials are encrypted at rest, with a key held outside the database and the source code. Sign-in sessions expire after 24 hours, or after 60 minutes without activity, and use secure, HTTP-only cookies. Repeated failed sign-ins lock the address out for 10 minutes. Inbound email is accepted only with Postmark's credentials, is rate-limited per organization, and can be limited to the senders your organization allows. Beacon's access to Google Drive is limited to the files it creates. Multi-factor authentication is not yet available.
Questions
Write to info@11foundry.com. Changes to how Beacon handles data are noted on this page.