Security overview
Biel.ai is designed to meet enterprise security requirements for data protection, compliance, and transparency.
Configurable security features
| Feature | Description |
|---|---|
| Role-based access (RBAC) | Restricts dashboard access to authorized users with segmented permissions. |
| Domain restrictions | Limits which domains can embed the assistant widget. |
| Rate limiting | Per-session and per-IP limits to prevent spam and abuse. |
| PII removal | Automatically detects and redacts names, emails, and phone numbers from conversations. |
| API key authentication | Enable Require authentication for all API access under Settings > Security & Privacy > Access Control to make a project private. Send keys as Authorization: Api-Key <token>. |
| Granular API permissions | Scope each API key to the operations it needs, such as projects_read, search, chats_create, and sources_create in API v2. Legacy names remain valid aliases. |
| Project-scoped API keys | Limit a key to a single project when you create it, so it can't reach your other projects or read the team. |
Security architecture
| Layer | Protection |
|---|---|
| Network | Firewalls, DDoS mitigation, continuous monitoring, and real-time alerts. |
| Data encryption | Encrypted in transit and at rest. Automated backups for recovery. |
| Audit logs | Detailed logs of security-sensitive operations for accountability. |
| Account isolation | Customer data is strictly separated between accounts. |
| No model training | Customer content and end-user conversations are not used to train third-party AI models. |
| GDPR support | A DPA, data controls, and EU data residency options support customer compliance requirements. |
See the Privacy Policy for details on data handling.