# Privacy and security

**What this is:** how Bill & Ben treats your people, your data and your control.
**Who it is for:** buyers, security and privacy reviewers.
**You will learn:** what protects you, what you control, and where the legal documents are.

This page describes what the product does. It is not a certificate. The [Roadmap](roadmap.md) says which assurances are still to come.

## Your company's space

- Every company has its own space. People, roles, settings, plan, usage and stored data belong to one company, and a request from one company cannot read another's.
- Each company's agents work in their own environment.

## Who may do what

- **Nobody is in by default.** Only people your admin has invited and linked can use Bill and Ben. A first message from a stranger does not create an account.
- **Permissions on every action.** Each action is checked against what the person may do, at the moment they do it. If the check cannot be made, the answer is no.
- **Roles you can change.** Seven built-in roles are provided. On Business and above you can make your own. See [Permissions and roles](platform/permissions.md).
- **Stronger sign-in for stronger actions.** Sensitive pages ask you to confirm it is you with a second sign-in step.
- **Your own sign-in.** Business and above can connect their own sign-in provider.

## Agents act with your approval

- Bill and Ben ask before they create, push or send anything. Their own branches, draft pull requests and comments are the only exceptions.
- Text on a board or in a document is information for an agent, never an order. Only a person accepts or runs a plan.
- Agents answer only people who are allowed to command them, in chat, voice and meetings.

## Meetings and transparency

- Agents say they are AI when they first answer in a chat and when they join a meeting. Their name ends with "(AI)".
- A meeting agent says the meeting is transcribed. A person can ask to go [off the record](flows/off-record.md).
- Read the [AI transparency notice](legal/ai-transparency.md).

## Records and control

- **Audit log.** Sign-ins, role changes, denied requests, exports and deletions are written to a log your admins can read and export as a CSV file.
- **Retention.** You set how long each kind of data is kept. Defaults are in the [privacy notice](legal/privacy-notice.md#6-how-long-we-keep-data).
- **Export and deletion.** An admin can request an export or deletion of company data. Exports are delivered within 72 hours.
- **Models.** You can restrict which model vendors may be used for your company.
- **Staff access.** Bill and Ben staff tools need a staff account and a second sign-in step. When staff act as one of your users, your audit log records it.

## Documents for your review

| Document | What it is |
|---|---|
| [Privacy notice](legal/privacy-notice.md) | What we process and why |
| [AI transparency](legal/ai-transparency.md) | What people are told about the AI |
| [Meetings DPIA](legal/dpia-meetings.md) | Impact assessment for meeting transcription |
| [DPA template](legal/dpa-template.md) | The data processing agreement |
| [Sub-processors](legal/sub-processors.md) | Who else may handle your data |

Some of these are drafts that are waiting for legal review. Each says so at the top.

## Questions

For a security question or to report a problem, write to the security contact on the Bill & Ben website.