Security and Compliance

Step 1: Understand Authentication

• BEEM uses AWS Cognito user pools for identity management
• Log in with your email-based username
• Password policy requires 8+ characters minimum
• SSO support is available for enterprise single sign-on
• Sessions are managed automatically with expiry handling

Step 2: Set Up Role-Based Access

1. Go to Members in the left sidebar
2. Assign each user the appropriate role:

• Organization Admin: Full access, manages members and settings
• Editor: Creates and edits content, no admin access
• Viewer: Read-only access to dashboards and AI Insights

Roles are assigned per workspace, providing fine-grained control.

Step 3: Configure Workspace Isolation

1. Create separate workspaces for different teams or projects
2. Users only see data in workspaces they are invited to
3. Share datasets across workspaces on a read-only basis (results only, SQL is hidden)

Step 4: Review Your Audit Trail

1. Open Monitor in the left sidebar
2. Filter events by date, object type, and status
3. Review who did what and when for compliance reporting

Compliance Standards

Data Residency

• All data is hosted on AWS ca-central-1 (Canada)
• Each client has a dedicated cloud environment
• Data never leaves your infrastructure when using AI Insights

Authorization Summary

• Organization-level user management
• Workspace-level member management with RBAC
• Dataset sharing controls: Share results without exposing underlying SQL
• Connection management: Organization Admin only