Security & Data Privacy
BetaHub is built with security and privacy at its core. This page outlines our security measures, infrastructure, and data protection practices.
Upsoft, the company behind BetaHub, is certified to ISO/IEC 27001:2022, and the certificate covers BetaHub. See Compliance & Certifications.
Infrastructure Security
Hosting Environment
- Provider: Amazon Web Services (AWS)
- Primary Region: EU-West-3 (Paris, France)
-
Architecture:
- AWS Elastic Beanstalk with EC2 instances
- PostgreSQL on RDS with Multi-AZ deployment
- Elastic Load Balancer (ELB) with auto-scaling
- Lambda functions for specific service endpoints
- CloudFront CDN for content delivery
Network Security
- DDoS Protection: AWS Shield Standard for CloudFront distributions, ELB and WAF layer protection
- Web Application Firewall: AWS WAF configured with custom rules to filter malicious traffic
- Load Balancing: Application Load Balancer with health checks and automatic failover
- Instance Lifecycle: EC2 instances automatically replaced regularly for security
Data Encryption
In Transit:
- HTTPS only (no HTTP traffic allowed)
- TLS 1.3 (with TLS 1.2 backward compatibility)
- SSL certificates managed through AWS Certificate Manager
At Rest:
- RDS database encryption enabled
- S3 buckets encrypted with AWS managed keys (SSE-S3)
- EBS volumes encrypted by default
- All backups encrypted
Access Control & Authentication
Customer Access
- Authentication Methods: GitHub OAuth, Discord OAuth, username/password
- Session Management: Secure session tokens, HTTP-only secure cookies
- CSRF Protection: On all state-changing operations
Internal Access Controls
- Production Access: Limited to authorized personnel only
- Access Management: IAM roles with least privilege principle, separate development and production environments
- Access Reviews: Quarterly review of all access permissions
- Access Revocation: Same-day removal following documented checklist
Data Protection & Privacy
Data Collection
Via Discord:
- Discord usernames and IDs
- Original messages (for context)
- Message links
Via Game Plugins:
- Only data explicitly sent by the game developer
- Typically includes: player IDs, hardware specifications, game logs
- No sensitive personal data (health, race, religion, sexual orientation, etc.)
- Log Redaction Patterns can automatically hide sensitive information (usernames, paths, tokens) in uploaded log files
Data Usage
- Data used solely for feedback management purposes
- No marketing or third-party sharing
- No profiling or automated decision-making
- AI features run on AWS Bedrock in EU regions. One opt-in feature, dynamic categories for suggestions, uses Google Gemini outside the EEA and is enabled only on customer request
Data Retention & Deletion
- Feedback Reports: Retained indefinitely by default; organization admins can configure automatic data retention to delete old inactive items
- Personal Data: Users can request PII removal at any time, processed within 30 days
- Backups: Regular automated snapshots with defined retention period
- Data Portability: Users can export their submitted bug reports and attachments from their profile
User Rights
- View your own personal data by authenticating
- Download your data (GDPR data portability)
- Request deletion of your PII
- Public visibility of reports is configurable per project
GDPR Compliance
- Privacy-first approach with minimal data collection
- Data processing strictly limited to stated purposes
- Primary data stored within the EU (France); see Sub-processors for the exceptions
- User rights fully implemented (access, rectification, erasure, portability)
- Privacy Policy: betahub.io/privacy
Sub-processors
These companies process customer data on BetaHub’s behalf. Integrations you turn on yourself (Discord, Steam, Jira, GitHub and others) are not listed: you choose to send data to them.
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, database, file storage, email and AI (Bedrock) | EU (Paris; AI in EU regions) |
| Sentry | Error monitoring; error reports can include user ID, email, IP address and request data | USA |
| Google (Gemini) | Dynamic categories for suggestions; off by default, enabled only on customer request | Outside the EEA |
Transfers outside the EEA follow the safeguards described in the Privacy Policy. A Data Processing Agreement (DPA) is available on request at security@betahub.io.
Security Operations
Monitoring & Logging
- Application Monitoring: AWS CloudWatch with custom metrics and dashboards
- Security Monitoring: Failed login attempts tracking, unusual API usage patterns detection
- Uptime Target: 99.5% with continuous tracking
Vulnerability Management
- Dependency Scanning: Snyk and GitHub Dependabot for continuous vulnerability scanning
- Update Policy: Security patches applied immediately upon alert
- Infrastructure Updates: Automatic OS patching through AWS Elastic Beanstalk
- Instance Rotation: EC2 instances automatically replaced regularly
Incident Response
- Incidents triaged and prioritized by severity
- Critical issues addressed immediately
- Incident commander assigned from core team
- Customer notification within 72 hours per GDPR requirements
- Post-incident review and documentation
Backup & Disaster Recovery
- Backup Frequency: Daily automated snapshots
- Multi-AZ Deployment: Automatic failover for database high availability
- Tested recovery procedures in place
Compliance & Certifications
ISO/IEC 27001:2022
Upsoft, the company behind BetaHub, is certified to ISO/IEC 27001:2022 by BSI.
- Certificate: IS 848432
- Scope: design, development and maintenance of the BetaHub platform
- Valid: 14 July 2026 to 13 July 2029, kept up by regular surveillance audits
- Verify: the certificate PDF and the BSI directory entry are at upsoft.dev/security
GDPR
- GDPR compliant operations
- Primary data residency in the EU; see Sub-processors
- Privacy by design principles implemented
Service Level Agreements
Uptime Commitment
- Target: 99.5% availability
- Monitoring: Continuous through AWS CloudWatch
Security Incident Communication
- GDPR breach notification within 72 hours to authorities
- Customer notification as soon as impact assessed
- Full disclosure of impact and remediation steps
Contact
General Security Inquiries:
- Email: security@betahub.io
- Response time: Within 24 business hours
Data Protection Officer:
- Piotr Korzuszek, CEO
- Company: Upsoft
See Also
- API Access – REST API and authentication
- Organizations – Team and organization management
- Project Settings – Configure data retention and project options
- Custom Roles – Fine-grained permissions with custom roles