Security & Data — BHASM
SECURITY & DATA

Your data goes nowhere you didn't send it.

Complete documentation of what BHASM reads, how it is stored, what it never does, and your rights as a data principal.

Compliance here is not a checklist — it is architecture. Privacy obligations are enforced as hard constraints inside the governance engine, the same layer that controls urgency scoring and hold decisions.

DOCUMENTVERSION 1.4

Security questionnaires, DPAs and the full sub-processor list on request: hello@bhasm.ai

SCOPE

What BHASM reads.

{{ r.src }}

{{ r.fields }}

{{ r.note }}

How your data is stored.

{{ s.k }}

{{ s.v }}

HARD LIMITS

What BHASM never does.

{{ n.num }}

{{ n.body }}

PRESSURE SIGNAL DETECTED

Customer raised a complaint. Silence enforced.

All outreach stops. No campaign, no brief item, no autonomous send — until the complaint is resolved, and a cooling period runs after that. The relationship is worth more than the message.

PAYMENT FAILURE DETECTED

Payment failed 3 days ago. Promo blocked.

Sending a promotional message to a customer with a failed payment creates regulatory exposure and destroys trust. BHASM treats this as an absolute block. No campaign setting lifts it.

THESE ARE NOT CONFIGURABLE — THEY ARE ARCHITECTURE. How the engine decides
COMPLIANCE

Enforced before a message is generated, not after it is sent.

{{ c.k }}

{{ c.v }}

OPERATIONAL POSTURE

Audit readiness, on the record.

ISOLATED AIRLOCK

Isolated Airlock encryption

Every tenant is encrypted under its own key, derived from a single master via HKDF-SHA256. A compromise of one tenant key decrypts nothing else. Security questionnaires and DPAs on request.

SERVICE LEVELS

Set in the written agreement, per account

This page publishes no availability figure. Nothing in the system measures availability today, so any figure printed here would have no instrument behind it. Ask for the agreement; that is the binding document.

BUSINESS CONTINUITY

BCP + escrow on request

Continuity plan, source-code escrow and second-party deploy options for enterprise tenants.

{{ p.k }}

{{ p.v }}

SHIPPED THIS CYCLE

Four things your security team will ask about. Each one already in production.

{{ s.tag }}

{{ s.title }}

{{ s.body }}

SECURITY QUESTIONS

Built for autonomous retention you can actually trust.

For security questions, data processing agreements or compliance documentation for your procurement team, write to us.

Autonomous sending stays off until you switch it on. That is the wall on every plan — not a tier, and not a setting we flip for you.