Bank-level security.
Because it has to be.
Your financial data is your most sensitive asset. We have architected beCrystal with enterprise-grade security and compliance, not as an afterthought, but as a foundation.
Security as a foundation, not an afterthought
End-to-end encryption
All data is encrypted in transit with TLS and at rest with AES-256.
Data isolation
Network segmentation with complete customer data separation.
Regular penetration testing
Third-party security assessments with documented remediation.
Information security management
A defined information security management system that guides our operations.
Secure development lifecycle
Formal change management with testing and approval processes.
Data retention control
Request deletion of your data at any time.
Compliance & standards
Meeting high standards for security and data protection
GDPR · SOC 2 Type 2 · ISO 27001 · Privacy by Design
Personal data, handled under GDPR
We respect your right to privacy and are committed to protecting personal data in compliance with the General Data Protection Regulation (GDPR) and other applicable laws.
Our role
beCrystal is the data processor when processing personal data on behalf of customers using our SaaS platform. Our customers are typically the data controllers under GDPR.
Our responsibilities are outlined in our Data Processing Agreement (DPA).
Data hosting & transfers
All data is hosted on Microsoft Azure in the European Union (West Europe and North Europe regions). We do not transfer personal data outside the EEA unless explicitly approved by the controller and safeguarded with Standard Contractual Clauses or adequacy decisions.
We use a limited number of sub-processors. You can view the full and updated list here.
Your rights
If your data is processed by beCrystal on behalf of a customer, please contact your service provider (the data controller) to exercise your rights. If you're unsure, contact us at privacy@becrystal.ai.
You also have the right to lodge a complaint with your national data protection authority — for Norway, www.datatilsynet.no.