Partner Society
United StatesSecurity & Device Verification
19-Layer Security Architecture · Compliance-First · Last updated: March 15, 2026
Security above everything. We pushed security to its absolute maximum. 19 independent layers — from silent carrier-level SIM verification (Android) and Apple attestation (iPhone) to country-bound geo-fencing — each designed to be unbreachable. Every layer is optional and configurable to adapt to your organization's unique environment.
iPhone: Apple device attestation
📱 3-Step Identity Verification
Every user goes through a chained verification process. Each step must pass before the next begins:
① Device Detection — We detect your device type (Android or iPhone) and verify at the hardware level. Administrators can restrict access to Android only, iPhone only, or both — but at least one mobile device type is always required.
② Carrier & Identity — Android: silent SIM verification directly with your carrier (Bell, Rogers, Telus, Vidéotron, Freedom Mobile in Canada; AT&T, T-Mobile, Verizon and 4 more in the US). VoIP and prepaid phones are rejected. iPhone: Apple device attestation and App Store account verification. Then email or enterprise SSO authentication.
③ Final Confirmation — Fully configurable: SMS code + Authenticator app (dual-layer), Authenticator app alone (TOTP), SMS code alone, or disabled entirely — depending on your organization's security requirements. Skipped automatically if your SSO provider already sent a code — no duplicate verification. Each Interest Point can enforce its own setting.
🔍 AI Identity Verification — When in doubt about identity, the AI can optionally send an SMS confirmation code or even call the number directly to ask verification questions — an optional step you can enable based on your security requirements.
CHAINED VERIFICATION · FULLY CONFIGURABLE · IMPOSSIBLE TO SPOOF
🔐 AUTHENTICATION & IDENTITY
1. SIM Card Verification
Silent carrier-level SIM verification (Android). Your identity is confirmed instantly by your carrier — no codes to enter. For iPhone, Apple device attestation and App Store account verification are used instead, achieving equivalent security.
CARRIER-LEVEL PROOF
2. Two-Factor Authentication
Multiple 2FA options: Authenticator apps (Google Authenticator, Microsoft Authenticator, Authy — TOTP standard), SMS OTP, or both combined. Administrators choose which methods are required per role.
CONFIGURABLE 2FA
3. Device Fingerprinting
Unique cryptographic identifier (ECDSA P-256) bound to your device via Web Crypto API. Private key stored as non-extractable in IndexedDB — literally cannot be exported by JavaScript.
UNIQUE DEVICE SIGNATURE
📱 DEVICE SECURITY
4. Encrypted Key Storage
Cryptographic key pair generated locally. private key never leaves the device, encrypted at rest in the browser's secure storage.
DEVICE-BOUND ENCRYPTION
5. GPS Location Verification
GPS coordinates collected during login with consent. Cross-referenced for suspicious access patterns and impossible travel detection.
GEO-VERIFICATION
6. IP Address Tracking
Every request logs the originating IP. Unusual changes trigger additional verification automatically.
AUTOMATIC IP MONITORING
7. Session Management
Sessions bound to device fingerprint and IP. Tokens expire after inactivity. Cross-tab logout broadcast ensures all browser tabs sign out simultaneously.
DEVICE-BOUND SESSIONS
🏗️ INFRASTRUCTURE
8. Data Isolation
Server-enforced rules ensure strict data isolation between organizations. Each organization's data is completely invisible to other organizations — including to Beyond IT itself when a client operates their own federal entity.
SERVER-ENFORCED ISOLATION
9. API Gateway Verification
Centralized gateway verifies authentication tokens, validates App Check signatures, enforces rate limits, and checks feature-level permissions on every single request.
CENTRALIZED GATE
📋 COMPLIANCE & AUDIT
10. Electronic Signatures & digital witness
All consent and agreement actions recorded with full audit trail: timestamp, IP, device, GPS, cryptographic SHA-256 hash. Sealed agreements are immutable — the platform acts as a digital witness with military-grade cryptographic proof.
LEGAL-GRADE AUDIT + CRYPTOGRAPHIC PROOF
11. Consent Logging & Version Tracking
Every consent logged with Immutable timestamps. Policy version tracking triggers mandatory re-consent when terms change.
IMMUTABLE CONSENT RECORDS
12. Enterprise Bot Protection
Enterprise-grade invisible reCAPTCHA protection against automated attacks, credential stuffing, and bot access.
INVISIBLE BOT PROTECTION
13. Security Scanner (DLP)
Real-time Data Loss Prevention scanning detects sensitive information (credit cards, SINs, SSNs, API keys, passwords — 9 types, 4 severity levels) before it leaves your organization.
REAL-TIME DATA SCANNING
14. Audit Logging
Every action, access, and security event logged immutably. Telephony logs retained 5+ years. Device trust events, QR verifications, key rotations — all tracked.
COMPLETE ACTIVITY HISTORY
🔒 DATA PROTECTION
15. Encryption at Rest
AES-256-GCM encryption for all stored credentials and sensitive data. Optional customer-managed encryption keys for maximum control.
AES-256-GCM ENCRYPTION
16. Encryption in Transit
TLS 1.3 encryption on all connections with certificate pinning on critical endpoints.
TLS 1.3 SECURE TRANSIT
17. Connections Hub (BYOS & Beyond)
Connect your own storage, identity providers, messaging systems, data targets, and code repositories through our unified Connections Hub. 14 storage providers supported: Google Drive, OneDrive, Dropbox, Amazon S3, GCP Cloud Storage, Azure Blob, Custom URL, Platform Storage, and 6 more (FTP, SFTP, WebDAV, SMB, Local/On-Prem, MinIO). Configure overflow strategies — failover, round-robin, cascade, replicate, or archive — so your data flows to backup storage automatically. Dual storage allows data to exist in multiple locations simultaneously for maximum resilience.
YOUR DATA, YOUR CONTROL
🚀 ADVANCED SECURITY
18. TOTP Authenticator
Compatible with Microsoft Authenticator, Google Authenticator, and others. QR code setup for seamless onboarding. Can be combined with SMS for dual-layer 2FA.
CONFIGURABLE AUTHENTICATOR
19. Geo-Fencing & Country Restriction
GPS required at login. Access can optionally be restricted to Canada or the United States based on your organizational settings. Suspicious access patterns between logins trigger automatic AI escalation to the designated administrator for that Interest Point. Combined with IP tracking and server-side GeoIP verification (configured on our WHM infrastructure via cPGuard and ModSecurity), this Optional layer provides end-to-end geographic restriction — from the browser to the server. Alert recipients are fully configurable — only the people you assign will be notified.
COUNTRY-BOUND ACCESS
Beyond the 19 Layers
Knowledge Vault — Enterprise Intelligence for Everyone
Store, organize, and query your documents (PDF, Word, images, videos, audio, URLs) in an encrypted space unique to your organization. But the Knowledge Vault is far more than storage — it's enterprise-grade Business Intelligence that was previously reserved for Fortune 500 companies paying $100+ per user per month. Thanks to a fundamental shift in AI capabilities, this level of intelligence is now accessible to every organization for a fraction of the cost.
🔍 Universal Search — One Word Finds Everything
Type a single word or phrase and instantly find every related item across your entire organization: documents, chat messages, video timestamps, audio transcriptions, meeting notes, emails, images with matching captions, and even handwritten notes that were scanned and indexed. The AI understands context — search for "safety protocol" and it finds the regulation, the training video at minute 12:34 where it was discussed, the chat thread from last Tuesday, and the PDF attachment on Interest Point #47.
🎥 Video & Audio Intelligence
Upload a video and the AI automatically transcribes, indexes, and makes every second searchable. Search inside videos the same way you search Google. Find the exact moment a topic was discussed in a 2-hour meeting. The same applies to audio files, voice memos, and recorded AI phone calls — every word is indexed and cross-referenced with your documents, Interest Points, and chat history.
📌 Ownership & Interest Point Flagging
Every document attached to an Interest Point is automatically flagged to its designated owner. When a document changes, the owner knows. When a search reveals a document they haven't reviewed, it's highlighted. When a regulation update impacts 12 documents across 5 Interest Points, every owner is notified simultaneously — with precise context about what changed and why it matters to them.
🧠 Why This Costs $2 Instead of $100
A fundamental shift in AI technology has made enterprise intelligence accessible to everyone. What required specialized infrastructure, dedicated data science teams, and enterprise contracts just months ago can now be delivered through modern AI models at a fraction of the cost. We pass this efficiency directly to you — no markup, no artificial tiers, no feature-gating. The same intelligence that powers billion-dollar enterprises is now available to a 5-person team for roughly the price of a coffee per user per month.
Security scanning, duplicate detection, multi-image extraction, auto-summaries, and policy updates across entire document groups are all included. No add-ons, no surprises.
ENTERPRISE INTELLIGENCE · UNIVERSAL SEARCH · $2/USER
AI Voice Verification & Device Intelligence
Our AI can call your phone number to personally verify your identity through a live conversation. The AI remembers interaction history — so in the event of a security breach, we have a verifiable voice trail to confirm exactly who was on the line.
Device Similarity Search: Our platform includes a proprietary search that identifies all similar devices across your organization. If a suspicious device is detected, the system can alert administrators and enforce additional verification — a capability that has never been seen anywhere else in the industry.
AI does not grant authentication. The AI is an additional security layer — it can verify, question, and escalate — but it never makes the final authentication decision. Authentication remains controlled entirely by the cryptographic and device verification chain.
On-demand verification enforcement: When the AI calls you (e.g., to confirm a sensitive transaction or a document update), it can dynamically request identity re-verification depending on the nature and sensitivity of the request. For high-value operations, the AI may require TOTP, biometric, or even a live supervisor callback before proceeding.
Custom security layers: Need something specific? We can build custom, organization-specific security rules and integrate them into the platform on demand. The security architecture is designed to be extended — there is no ceiling.
This feature can be enforced by federal-level policies that cannot be overridden by lower levels in the hierarchy.
VERIFIABLE VOICE TRAIL · DEVICE INTELLIGENCE · EXTENSIBLE
Hierarchical Security Cascade (Federal Model)
Every security feature on this page is optional and fully granular. Each of the 19 layers can be turned on, off, or customized at any level in the hierarchy — from the entire organization down to a single Interest Point or individual account. This means a public-facing Interest Point can have minimal security while a sensitive one in the same organization enforces all 19 layers. When a setting is made mandatory at a higher level, no lower level can override it — the most restrictive rule always wins.
Custom compliance rules can be rapidly created by our AI developers using embedding technology and integrated into the governance layer at any level you choose.
SSO & Smart SMS Verification
Sign in via Google, Microsoft, GitHub, Apple, or your corporate SSO (SAML/OIDC). If your SSO provider already sent you an SMS code, we won't send another one — no duplicate verification. A single account can link multiple SSO providers simultaneously. Phone verification and device attestation are mandatory regardless of sign-in method.
SMART ANTI-DUPLICATE SMS
Guard Phone Model (Shared Devices)
For shared-device environments: QR-based authentication with full 4-layer attestation. Ideal for hospital environments and enterprise kiosks where multiple users share the same terminal.
SECURE SHARED-DEVICE ACCESS
100% Vocal Platform
The entire platform can operate 100% by voice. Some users won't even need to know the software — they interact entirely through AI-powered voice calls. Navigate, manage, and operate everything vocally.
FULL VOCAL OPERATION
Bring Your Own AI (BYOAI)
Beyond IT includes a high-performance enterprise AI optimized for voice at the lowest possible cost — everything works out of the box. Want 100% confidentiality over your AI interactions? You can optionally route your data through your own AI provider — compatible with OpenAI, Anthropic, Google, Microsoft, and others. BYOAI is always available as an extra option, never a requirement.
INCLUDED AI · OPTIONAL BYOAI
On-Premises Deployment
Install the entire platform on your own infrastructure. Plug your own AI models, databases, storage, and operate with full data sovereignty. No data ever leaves your network. Ideal for banking, healthcare, and government environments requiring maximum isolation.
FULL DATA SOVEREIGNTY
Connections Hub & Integration Security
The platform provides a unified Connections Hub with 5 integration categories, each with security at every step:
- Storage (14 providers) — Google Drive, OneDrive, Dropbox, Amazon S3, GCP Cloud Storage, Azure Blob, Custom URL, Platform Storage, FTP, SFTP, WebDAV, SMB, Local/On-Prem, MinIO. Each with encryption toggle on imports.
- Identity — SSO, SAML, SCIM provisioning for enterprise user management.
- Messaging — Microsoft Teams, Slack, Discord — for automated notifications and alerts.
- Data Targets — CRM (Salesforce, HubSpot, Pipedrive), Accounting (QuickBooks, Xero, FreshBooks), HR (BambooHR, Workday, ADP), Project Management (Jira, Asana, Monday, Trello, Linear), E-commerce (Shopify, Square).
- Code Repos & Repository AI — Connect your Git, GitHub, GitLab, or Bitbucket repositories and make your code intelligent. The AI indexes your entire codebase via embedding, enabling semantic search, change impact analysis, vulnerability detection, and automatic documentation. Every commit is analyzed — the AI understands your code like a senior developer would. A service rarely offered by companies, but one we consider essential for your technical teams' productivity.
Overflow & Resilience: Configure failover, round-robin, cascade, replicate, or archive strategies so data automatically routes to backup storage when primary storage is full or unreachable. Health monitoring with up to 10 alert channels (in-app, email, SMS, AI phone call, Datadog, webhook, Slack/Teams, PagerDuty, and more).
DLP Scanning: All imported files pass through automatic Data Loss Prevention scanning before entering the Knowledge Vault.
Event Streaming & Metrics
Every significant platform event — logins, document changes, agreement seals, configuration updates, storage operations, AI interactions — is captured as a structured event. Export your metrics to the observability stack of your choice:
- Google Pub/Sub — Native integration for real-time event streaming to your GCP ecosystem.
- Apache Kafka — Connect to your Kafka cluster for high-throughput event processing and streaming analytics.
- Webhooks — Push events to any HTTP endpoint — compatible with Zapier, Make, n8n, or custom backends.
- Datadog / New Relic / Grafana — Export platform health metrics, API latency, error rates, and usage dashboards.
- Custom Event API — Build your own consumers with our structured JSON event schema.
All event streams are authenticated with scoped API keys and encrypted in transit. Your federal entity controls which events are emitted and to which destinations — Beyond IT cannot read your event stream.
REAL-TIME EVENT CAPTURE
Telephony Enforcement (Hard-Block)
Platform-level hard-blocks for calling compliance. Timezone mapping, consent validation, DNC/DNCL sync (31 days), 3-year internal exclusion list. Zero-tolerance enforcement that cannot be bypassed by any user or administrator.
ZERO-TOLERANCE CALLING COMPLIANCE
Smart Observables & Law Monitor
Continuous regulatory and pricing monitoring. anomaly detection AI with automatic circuit breakers. AI can call you or escalate to your team when changes are detected. Observables can trigger automatic document updates across your Knowledge Vault.
REAL-TIME REGULATORY MONITORING
CASL Compliance, Consent & Scoped Access
In Quebec, bilingual (French and English) disclaimers on invitations are mandatory under Law 25 and Bill 96. In all other Canadian provinces, French is not required — disclaimers adapt automatically to the applicable jurisdiction. Expert access is NDA-governed, time-limited, with no financial data visibility.
Consent Form Builder: Every organization can build custom consent forms and add extra clauses directly from their settings. When regulations change, updating your consent requirements across every Interest Point takes seconds — ensuring your entire organization stays compliant without manual intervention.
JURISDICTION-AWARE CONSENT · FORM BUILDER · EXPERT ISOLATION
CANADIAN CALLING HOURS (CRTC)
| Timezone | Weekday | Weekend | Regions |
|---|---|---|---|
| Pacific (PT) | 9AM–9:30PM | 10AM–6PM | BC, Yukon |
| Mountain (MT) | 9AM–9:30PM | 10AM–6PM | Alberta (HQ), NWT |
| Central (CT) | 9AM–9:30PM | 10AM–6PM | Manitoba, SK |
| Eastern (ET) | 9AM–9:30PM | 10AM–6PM | Ontario, Quebec |
| Atlantic (AT) | 9AM–9:30PM | 10AM–6PM | NB, NS, PEI |
| Newfoundland (NT) | 9AM–9:30PM | 10AM–6PM | Newfoundland |
These windows apply to unsolicited (cold) calls. For AI-assisted calls, express consent is always required. Employer-to-employee communications are governed by organizational consent agreements, configurable per group.
Access Control & Configuration
Profile-Based Access Control
Each user receives a server-enforced permission profile that controls both what they see in the interface and what the API allows them to access:
- Visual Profile Creator — Administrators preview the exact user interface with checkboxes overlaid on every menu, section, button, and data field. Uncheck elements, save as a profile — access is configured instantly, visually.
- 5 Built-in Templates — Super Admin, Admin, Manager, Employee, Viewer — or create fully custom profiles from scratch.
- Field-Level & Document-Level Masking — Hide specific data fields (phone numbers, addresses, salaries), mask specific words or numbers within documents, or hide entire paragraphs from certain roles. You control what each person sees down to individual words.
- Per-Interest-Point Access — Each Interest Point can have its own access rules. Invite external participants to a specific Interest Point with restricted visibility while internal members retain full access — ideal for negotiations, collective agreement voting, insurance onboarding, or client portals.
- Groups — Create groups to manage permissions at scale. Assign a profile to a group and every member inherits it instantly. Move someone between groups and their access updates in real time.
- Knowledge Vault Integration — Access control extends into your document intelligence layer. The Knowledge Vault can match documents to access rules automatically — when a rule changes, the system instantly flags every related document across all Interest Points and notifies the designated owners.
- Server-Enforced — Even if someone crafts manual API calls, the gateway blocks unauthorized actions. No client-side bypass possible.
- Per-Document Roles — Writer, Reader, Drop-only, or None access for each document, with AI analysis toggle per role.
🧠 AI That Learns With You: As your Knowledge Vault grows with documents, decisions, rules, and interactions, the AI serving your organization becomes progressively smarter. It builds a living, contextual understanding of your business — so its suggestions, searches, and verifications become more precise and relevant over time. The AI doesn't just store data — it learns from your actions, your rules, and the changes you make.
Incident Response
- Detection — Real-time monitoring, anomaly detection via AI, and automated alerting for suspicious activity.
- Classification — Incidents classified by severity (P1 Critical, P2 High, P3 Medium, P4 Low) and escalated accordingly.
- Containment — Immediate isolation of affected systems. Compromised accounts suspended and devices revoked within minutes.
- Notification — Affected users notified within 72 hours of confirmed data breaches, as required by PIPEDA and Law 25.
- Recovery — Systems restored from verified backups. Post-incident review within 7 days.
Backup & Disaster Recovery
- Automated backups — Firestore data automatically backed up by Google Cloud with point-in-time recovery.
- Geographic redundancy — Data replicated across multiple geographic zones within North America.
- RTO — Target service restoration within 4 hours for critical systems.
- RPO — Maximum 1 hour of data loss in worst-case scenarios.
- BYOS protection — If you use your own storage, your data is additionally protected by your provider's backup policies.
- Overflow resilience — Configured overflow strategies (failover, replicate, cascade) ensure data is preserved even if a primary storage provider has an outage.
Vulnerability Management & Compliance
- Dependency scanning — Automated scanning of all software dependencies for known vulnerabilities.
- Regular updates — Security patches applied promptly.
- Code review — All security-sensitive code changes reviewed before deployment.
- Third-party risk — All subprocessors (Google Cloud, Firebase, telephony providers) vetted for security certifications.
- SOC 2 Type II — Architecture designed toward SOC 2 compliance. Formal audit on compliance roadmap.
- ISO 27001 — Information Security Management System principles embedded in development and operations.
- Target uptime — 99.9% availability for all production services, monitored 24/7.
CANADIAN COMPLIANCEThis platform complies with PIPEDA, Quebec Law 25, CRTC rules, CASL, and the National DNCL. Mandatory data breach notification. Automated decision-making transparency (Law 25).
Eastern Canadian data is stored in Google Cloud's northamerica-northeast1 (Montréal) region. Western Canadian data is stored in northamerica-northeast2 (Edmonton), also covering British Columbia. For the United States, multiple Google Cloud regions are available for optimal compliance. Beyond IT Inc. has offices in Montréal and Alberta, Canada.
For security inquiries: security@beyondit.co